GitHub Enterprise adds credential inventory exports
By Steven Van ·
Enterprise owners can export every SSH key, PAT, OAuth, and GitHub App token that can access their org, via settings or a new REST API.
GitHub Enterprise Cloud now lets enterprise owners export a full inventory of the credentials that can access their enterprise, including SSH keys, classic and fine-grained personal access tokens, OAuth App access tokens, and GitHub App user-to-server and installation tokens. Owners and members with the fine-grained "View enterprise credentials" permission can find the export next to the Overview section under enterprise Settings > Authentication security > Credentials, or pull it through a new paginated REST API.
The CSV includes one row per credential-organization pairing, with metadata such as owner, scopes and permissions, creation and expiration dates, last-used dates, and the organizations or repositories a credential can reach. Each row can be matched to audit log events by comparing token IDs, hashed token values, or SSH key fingerprints, without needing the original token value. GitHub says this is meant to help security teams assess risk and plan remediation during an incident, and to support compliance audits. The feature is live now for GitHub Enterprise Cloud, with GitHub Enterprise Server support planned for a future release.
