# GitHub App improvements for least privilege and management

By Steven Van · 2026-10-13

Both GitHub Apps and fine-grained personal access tokens gain permissions for repository creation and installation access management.

Apps and fine-grained personal access tokens on [GitHub](<https://creatorstoolbox.com/tools/github>) can now create repositories and manage installation access with two new, narrower permissions. Repository administrators also have more flexibility to add repositories to apps their organization owners have already approved.

## Create repositories with fewer permissions

The new repository\_creation:write permission allows an app or token to create repositories in the account where it is granted. Previously, this required repository\_administration:write, which also permits actions such as deletion and transfer.

The app or user that creates a repository receives access to it. An app using the new permission still requires an organization administrator to install it.

## Manage which repositories an installation can access

The APIs for adding a repository to an organization installation and removing it now support GitHub Apps and fine-grained personal access tokens. Previously, they only supported the broader repo scope.

The new installation\_repositories:write permission allows the caller to add or remove the repository from any installation in the organization. A user making the request must also be an organization owner or an administrator of that repository.

## Extend access to approved apps

As the [installation requirements](<https://docs.github.com/apps/using-github-apps/installing-a-github-app-from-a-third-party#requirements-to-install-a-github-app>) explain, repository administrators can give an app access to repositories they administer if an organization owner has already installed it. This applies regardless of the app’s permissions, because the owner approved those permissions during installation.

Organization owners can restrict this ability. When that restriction is enabled, repository administrators must request installation from an owner. GitHub has also updated its app credential management interface ahead of planned workload federation features.

![Screenshot of the page to install a GitHub App. The app requests read access to metadata and write access to issues.](<https://docs.github.com/assets/cb-118277/images/github-apps/install-app.png>)

GitHub App installation screen requesting metadata read access and issues write access.

![GitHub](<https://github.githubassets.com/assets/GitHub-Mark-ea2971cee799.png>)

GitHub

Where the world builds software — Git hosting, pull requests, issues, Actions CI/CD, and Copilot, free for public and private repos.

[View GitHub →](<https://creatorstoolbox.com/tools/github>)

[Original source](<https://github.blog/changelog/2026-10-13-github-app-improvements-for-least-privilege-and-management>)

[Read GitHub App improvements for least privilege and management on Creators Toolbox](<https://creatorstoolbox.com/blog/github-github-app-improvements-for-least-privilege-and-management>)

---
Canonical source: https://creatorstoolbox.com/blog/github-github-app-improvements-for-least-privilege-and-management