What Is a Runner Registration Token? Enrolling a Runner
A runner registration token is a short-lived credential that authorizes a new runner agent to enroll with your repository or organization.
Before a runner can pick up jobs, it has to register. The registration token is how GitHub verifies that whoever is adding the runner is allowed to. It is deliberately short-lived to limit the damage if it leaks.
What it does
When you set up a runner, GitHub issues a registration token. The runner presents it during enrollment to prove it is authorized to join your repo or org. Once registered, the runner uses its own credentials to receive jobs.
Why it expires
Registration tokens are short-lived (on the order of an hour). If one leaks, the window to misuse it is small. Automated runner systems fetch a fresh token each time they enroll a machine rather than caching one.
Token registration vs JIT
A registration token can enroll runners repeatedly within its lifetime, which suits warm pools that pre-register several machines. JIT configs are single-use per runner, which suits one-off cold-start machines. Many platforms use both.
Common token errors
- Expired token: enrollment fails because the token aged out - fetch a fresh one.
- Wrong scope: a repo token cannot register an org runner and vice versa.
- Clock skew: a badly wrong runner clock can make a valid token look expired.
Tokens you never have to handle
On a managed platform, registration and token rotation happen automatically as runners are provisioned and torn down. Latchkey enrolls and retires runners for you, so expired-token and wrong-scope errors are simply not something you manage.
Key takeaways
- A registration token authorizes a runner to enroll with a repo or org.
- It is short-lived to limit the impact of a leak.
- Tokens can enroll multiple runners; JIT configs are single-use.
- Expiry, wrong scope, and clock skew are the usual failure modes.