GitHub Apps can now create repositories without administration rights
Serguey Asael Shinder2 min readGitHub announced a set of changes to GitHub Apps on 13 October 2026, framed around two goals: moving automation off classic personal access tokens and letting apps ask for less than they used to.
Two new fine-grained permissions. Until now, creating a repository required repository_administration:write, which also covers deleting and transferring repositories. GitHub's own explanation is that this pushed administrators into bad choices — rejecting the app, banning tokens with that permission, or accepting the over-privilege. The new repository_creation:write grants only creation; the creator gets access to the new repository, and an app using it still has to be installed by an organization administrator. A second permission, installation_repositories:write, works per repository and allows adding that repository to, or removing it from, any app installation in the organization. The corresponding organization APIs, which previously accepted only the coarse repo scope, now accept GitHub Apps and fine-grained PATs; a user caller must additionally be an organization owner or an admin of that repository.
Repository admins can extend approved apps. Apps requesting organization-level access used to be blocked from installation by repository administrators in every case. That is relaxed when the app is already installed in the organization: a repository admin can now add their repository to the existing installation without owner approval, because the app's organization-level access does not grow. Three permission sets still require an owner — all organization-level permissions, repository administration and the new repository creation. Organizations that want the old behaviour can restrict installation to owners.
Tokens that expire again. GitHub Apps now accept the offline_access scope, as OAuth apps do. Developers who once disabled expiring user tokens can re-enable expiration gradually: a session that requests offline_access receives a refresh token alongside the short-lived access token, without forcing every existing client onto expiring tokens at once. Permissions themselves are still fixed in the app registration.
Admin and audit changes. Apps can call the Get an app API for private and internal apps that share an owner — same organization, same enterprise for internal apps, or enterprise-to-organization — which GitHub positions as a basis for automated app auditing. Credentials move to a dedicated Credentials tab, which GitHub says makes room for planned workload federation credentials.
For GitHub Enterprise Server, offline_access arrives in GHES 3.23 and the rest in GHES 3.24.
Source: GitHub Changelog, "GitHub App improvements for least privilege and management" — https://github.blog/changelog/2026-10-13-github-app-improvements-for-least-privilege-and-management