actions/create-github-app-token

Mint a short-lived GitHub App installation token to use instead of a PAT or GITHUB_TOKEN.

Official actionCategory: Utilities & ScriptingLatest v3View on GitHub

What it does

actions/create-github-app-token creates an installation access token for a GitHub App, for cases where GITHUB_TOKEN is not enough: pushing commits that should trigger other workflows, or acting across repositories.

The token can be narrowed to specific repositories and specific permissions (e.g. permission-contents: write), and is revoked automatically when the job completes unless skip-token-revoke is set.

Usage

workflow (.yml)

steps:
  - id: app-token
    uses: actions/create-github-app-token@v3
    with:
      client-id: ${{ vars.APP_CLIENT_ID }}
      private-key: ${{ secrets.APP_PRIVATE_KEY }}
  - uses: actions/checkout@v4
    with:
      token: ${{ steps.app-token.outputs.token }}

Inputs

Input	Description	Default	Required
`client-id`	GitHub App Client ID.	-	No
`private-key`	GitHub App private key.	-	Yes
`owner`	The owner of the GitHub App installation (defaults to current repository owner).	-	No
`repositories`	Comma or newline-separated list of repositories to grant the token access to (defaults to current repository if owner is unset).	-	No
`skip-token-revoke`	If true, the token will not be revoked when the current job is complete.	`false`	No
`permission-contents`	Permission level to grant for repository contents, commits, branches, releases: read or write. One of many permission-* inputs for narrowing the token.	-	No

Outputs

Output	Description
`token`	GitHub installation access token.
`installation-id`	GitHub App installation ID.
`app-slug`	GitHub App slug.

Notes

Commits and API calls made with an app token can trigger downstream workflows, unlike GITHUB_TOKEN, which deliberately does not retrigger workflows.

By default the token is scoped to the current repository; set owner (and optionally repositories) to reach other repos the app is installed on.

Common errors

Input required and not supplied: private-key means the secret reference resolved empty; check the secret name and that it is available to the calling repo/environment.
Token creation failing with a 404 usually means the app is not installed on the target owner/repositories, or the installation does not include those repos.

Security and pinning

App installation tokens beat PATs: they are short-lived (about an hour, and revoked after the job by default), scoped to explicit repositories and permissions, and not tied to a human account that can leave the org. Keep the app private key only in an encrypted secret.
Narrow every token with repositories and the permission-* inputs to the minimum the job needs, rather than inheriting all of the app's permissions.

Alternatives and related

actions/github-scriptRun inline JavaScript with a preauthenticated GitHub API client, no separate action needed. peter-evans/create-pull-requestCommit changes made during a workflow and open (or update) a pull request with them.

Frequently asked questions

Why do commits pushed with GITHUB_TOKEN not trigger my other workflows?

GitHub suppresses workflow runs for events created with GITHUB_TOKEN to prevent recursion. Pushing with a GitHub App installation token from this action re-enables those downstream triggers.

References

GitHub Actions documentation