Automate SSO authorization for classic PATs and SSH keys
By Steven Van ·
A new REST API lets enterprise admins bulk-authorize a token or SSH key across up to 50 SSO-protected organizations at once.
Enterprise admins on GitHub can now automate SSO authorization for existing classic personal access tokens and SSH keys, instead of having developers authorize each organization by hand.
Enterprises with multiple SSO-protected organizations previously required per-organization authorization, which pushed some teams toward long-lived tokens to avoid the hassle of rotation. Admins can now opt in to a setting that allows credential delegation through enterprise-installed GitHub Apps with the enterprise_credentials:write permission. Those apps can call a new REST API to bulk-authorize a classic PAT or SSH key across up to 50 organizations in a single request.
- The credential is identified by its non-secret token ID or SSH key fingerprint, so no credential secrets pass through the GitHub App.
- Before granting authorization, the API confirms each target organization belongs to the enterprise, the credential owner belongs to each organization, and the enterprise uses enterprise-level SSO.
- Organizations with an existing active authorization are skipped.
This is available now for GitHub Enterprise Cloud accounts.
