Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Audit GitHub credentials in two places: organization owners review fine-grained personal access tokens (PATs) from the organization’s Settings → Personal access tokens → Active tokens page, while account holders review OAuth grants from Profile picture → Settings → Applications → Authorized OAuth Apps. Revoke anything unrecognized, obsolete, expired, or broader than necessary. Treat a leaked token as compromised: revoke it immediately through GitHub’s credential-revocation API, rotate dependent secrets, and create a narrowly scoped replacement because GitHub cannot restore a revoked credential.
What you are auditing
GitHub credentials fall into two related but different categories. A personal access token authenticates requests as a user. An OAuth app authorization is a grant that lets an application obtain and use tokens on that user’s behalf. Revoking one PAT affects that credential; revoking an OAuth authorization removes the grant and every token issued through it.
Keep these objects separate in your inventory:
- Classic PAT: a user token governed by broad scopes. Organization owners cannot see classic PATs in the organization’s active-token view. Unless an organization policy restricts classic PAT access, a classic token can continue to reach organization resources until it expires.
- Fine-grained PAT: a token with an owner, selected repositories, and explicit permissions. Organization owners can review and revoke its organization access.
- OAuth app authorization: an approval connecting a GitHub account to an OAuth application. The authorization can have one or more associated tokens.
- GitHub App user token: a token issued through a GitHub App authorization rather than an OAuth app. It belongs in the same incident inventory when a leaked credential is being contained.
Record the owner, creation and last-use details when GitHub displays them, expiration, repository selection, scopes or fine-grained permissions, organization and SSO status, and the integration that depends on the credential. This makes an apparently harmless token distinguishable from one that can read private code or write to production repositories.
Audit fine-grained PAT access as an organization owner
The organization-level review is the authoritative place for owners to see fine-grained PAT access to that organization.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
- Open the organization in GitHub.
- Select Settings.
- Under Personal access tokens, select Active tokens.
- Inspect the listed fine-grained tokens. Use the available filters for token owner, repository, or permission to narrow the review.
- Open each relevant token’s details and compare its repository selection, permissions, expiration, and owner with the integration inventory.
- Select one or more tokens that should no longer have access and choose Revoke.
This view lets an organization owner remove the organization’s authorization for fine-grained tokens. It does not provide a list of classic PATs. A missing classic token in this screen is therefore not evidence that no classic token can reach the organization.
What to remove
- Tokens whose owner has left the organization or changed roles.
- Tokens for decommissioned build jobs, scripts, or integrations.
- Tokens with repository access that exceeds the job’s actual requirement.
- Tokens with permissions that are no longer used, even when the token has not expired.
- Expired credentials and tokens with no identifiable owner or business purpose.
What revocation does
Revoking a fine-grained token’s organization access blocks that token from the organization. It does not restore or edit the token, and it does not automatically create a replacement. If a legitimate workflow still needs access, its owner must create a new credential with the smallest repository and permission set that works, then update the workflow secret.
Audit your own PAT inventory
Organization owners see organization access, not a complete account-wide history of every token a user has ever created. Each user should review the personal-access-token settings available in their account and reconcile every active credential with an owner, purpose, expiration date, repository set, and required permission. Keep a record outside GitHub that identifies the consuming workflow without storing the secret value itself.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →For each token, ask:
- Is the token still active and within its intended lifetime?
- Does its owner still need it?
- Does it reach repositories or organizations unrelated to the task?
- Are write, administration, or other elevated permissions necessary?
- Is the token protected by the organization’s SSO or approval requirements where applicable?
- Can the dependent automation be migrated to a more narrowly bounded credential?
Do not copy a token into the inventory. Store only identifying metadata and the location of the secret in your approved secret manager.
Why classic PATs need a separate control
Classic PATs use broad scopes and are not shown in the organization owner’s fine-grained active-token screen. If the organization has not restricted classic PAT access, a valid classic PAT can access organization resources until its expiration date. The practical consequence is that an organization review must combine owner controls with policy: restrict or require approval for classic-token use where possible, ask users to retire old classic credentials, and examine audit events for authorization changes.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
When a classic PAT is suspected, the user who owns it should revoke or delete the token from their account. If the issue is organization-specific SSO authorization, remove that authorization as well. Enterprise guidance distinguishes these actions from fine-grained PAT handling: revoke the fine-grained token’s organization access, revoke classic PAT SSO authorization or delete the classic token, and deny an OAuth app at the organization level when the app is the problem.
Review and revoke OAuth app access
OAuth grants are reviewed per user rather than from the organization’s fine-grained-token page.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- Select your profile picture in GitHub.
- Choose Settings.
- Open Applications.
- Select Authorized OAuth Apps.
- Review each application’s name, authorization date, tokens, and permissions.
- For an app you do not recognize or no longer use, open its action menu and choose Revoke.
- To invalidate every token issued through the listed authorization, choose Revoke all when that option is shown.
GitHub’s documented rule is explicit: “Once an authorization is revoked, any tokens associated with the authorization will be revoked as well.” Reauthorization is not a restoration operation; the user must return to the third-party application or website and connect the GitHub account again.
How to judge private-repository exposure
Read the permissions shown for the grant and identify whether the application was authorized for private-repository data. A grant that includes private-repository read or write capability should be treated as sensitive even if the application is familiar. Also check whether the authorization belongs to an integration that has since changed ownership, scope, or purpose. If the displayed permissions are broader than the integration’s current job, revoke the grant and reconnect only after the application can request a narrower set.
Deleting one user’s grant as an OAuth app owner
An OAuth app owner can delete a specific user’s app authorization through GitHub’s REST API. Deleting the grant removes every OAuth token for that user and removes the app from that user’s authorization-settings screen. This is different from asking the user to revoke access: the app owner can perform the deletion for the affected account, subject to the API’s authentication and ownership requirements.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Understand the scope of each revocation
| Credential or authorization | Who can revoke it | What is affected | Can it be restored? | Useful verification signal |
|---|---|---|---|---|
| Fine-grained PAT organization access | Organization owner; supported automation through an authorized GitHub App | The token’s access to that organization | No; create a replacement if needed | Successful API response or organization security/audit event |
| Classic PAT | Token owner; organization or enterprise controls can remove SSO authorization or deny use | The token, or its organization authorization depending on the action | No | Token no longer authenticates; audit event where policy action is recorded |
| OAuth app authorization | User; OAuth app owner can delete an individual user grant; organization or enterprise owner can deny app access | The authorization and all tokens associated with it | No; reconnect through the app | Authorization disappears, tokens fail, and an audit event may be recorded |
| GitHub App user authorization | User, app owner, or organization policy administrator according to the authorization | The authorization and its user tokens | No | Token failure and security/audit-log event |
Revocation is intentionally irreversible. A successful operation is a security boundary, not a temporary pause.
Respond immediately when a token leaks
Assume a credential is compromised if it appears in a public repository, gist, issue, log, screen recording, chat transcript, or other location outside the approved secret store. Do not wait for evidence of misuse and do not simply delete the visible copy while leaving the credential active.
- Identify the credential type from its prefix or context. GitHub’s credential-revocation API accepts classic PATs beginning with
ghp_, fine-grained PATs beginning withgithub_pat_, OAuth app tokens beginning withgho_, GitHub App user-to-server tokens beginning withghu_, and GitHub App refresh tokens beginning withghr_. - Submit the exposed value to GitHub’s credential-revocation API. GitHub states that authentication is not required for these revocation requests, which is important when the leaked value can no longer be trusted. Use the documented endpoint for the credential type and confirm the HTTP result.
- Remove the secret from every exposed location. Purge it from the repository history or log system where feasible, but understand that cleanup does not replace revocation because copies may already exist.
- Rotate dependent secrets. Change deployment variables, CI secrets, signing or webhook credentials, and any downstream service keys that were accessible through the compromised workflow.
- Create a replacement only if the workflow still needs GitHub access. Match the replacement to the smallest repository set, permission set, lifetime, and organization approval requirement that supports the job.
- Re-test the workflow. A revoked credential cannot be re-enabled, so update every consumer and verify both successful authorized operations and expected failures for operations that should no longer be permitted.
The credential-revocation API is designed for exposed credentials found on GitHub or elsewhere. It is separate from an organization owner’s active-token screen and is the fastest containment path when the secret itself has escaped.
Automatic revocation events to account for
GitHub documents several automatic triggers:
- A token is revoked at its expiration date.
- A valid OAuth token, GitHub App token, or personal access token pushed to a public repository or gist is automatically revoked.
- An OAuth token or personal token that has not been used for one year is automatically revoked.
Once a token has expired or been revoked, it can no longer authenticate Git or API requests. Automation should therefore handle authentication failures as a credential-lifecycle event, not endlessly retry the old value. Alert the owner, identify the intended replacement process, and avoid printing the failed secret or its full value in logs.
Automate fine-grained PAT organization revocation safely
GitHub documents REST endpoints for updating a fine-grained PAT’s organization access. The operation is limited to revoking existing access; it does not grant new access. It is restricted to GitHub Apps, requires the organization’s Personal access tokens permission with write access, and returns HTTP 204 on success.
Recommended Free Tools
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Use this automation pattern:
- Run the job as an approved GitHub App rather than embedding a user PAT in the revocation service.
- Give the app only the organization permission required to manage personal-token access.
- Resolve the token and organization identifiers from your controlled inventory.
- Submit the documented revoke-access request.
- Treat HTTP 204 as the successful API signal and record the actor, target, time, and change ticket without recording the token value.
- Check the organization security or audit log for the corresponding authorization event.
Because the endpoint cannot create or broaden access, provisioning remains a separate, reviewed workflow. Keep those paths separate so a revocation job cannot accidentally become an access-granting service.
Organization and enterprise guardrails
Prevention is more reliable than periodic cleanup. Organization owners can apply personal-access-token policies, require approval for fine-grained PAT requests, review active fine-grained tokens, and limit OAuth app and GitHub App access requests. Use those controls to establish a default-deny posture for integrations that do not have a clear owner or business purpose.
Approval design
- Require an owner to justify the repositories and permissions requested by a fine-grained PAT.
- Set expiration expectations that match the task instead of allowing indefinite credentials.
- Require applications that handle private repositories to identify their data need and operator.
- Review exceptions on a schedule and remove them when the project ends.
Audit-log events to monitor
Enterprise guidance identifies events that help verify the change:
org_credential_authorization.deauthorizeorg_credential_authorization.revokepersonal_access_token.access_revokedoauth_access.destroypersonal_access_token.destroy
Correlate the event with the requestor, target credential or authorization, organization, timestamp, and incident or change record. An email notification can be useful, but the audit event and the failed-authentication test are stronger operational evidence.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchA repeatable audit checklist
- Build the inventory. List every PAT and OAuth grant, its owner, creation and last-use information where available, expiration, repositories, scopes or fine-grained permissions, and organization or SSO status.
- Classify exposure. Mark credentials as recognized, unknown, unused, over-scoped, expired, tied to a departed user, or associated with an obsolete integration.
- Remove unnecessary access. Revoke fine-grained organization access, delete or revoke classic PATs, and revoke OAuth grants that are not required.
- Contain leaks first. Send exposed credentials to the credential-revocation API before attempting cleanup of the location where they appeared.
- Rotate dependencies. Replace CI variables, deployment secrets, and downstream keys that could have been reached.
- Apply policy. Require approvals, limit app access, and set ownership and expiration expectations for new credentials.
- Verify. Check the security or audit log, confirm the expected event, and test that the old credential fails.
- Re-test replacements. Confirm the new credential can perform the required operation but cannot access repositories or permissions outside its design.
Troubleshooting common audit problems
The token is not visible under Active tokens
That page is for organization review of fine-grained PAT access and does not show classic PATs. Ask the token owner to inspect the account’s PAT settings, and check whether organization policy or SSO authorization is the relevant control.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Revoking an OAuth app broke a build or integration
The revocation removed every token associated with that authorization. Reconnect the GitHub account through the application, approve only the permissions the integration needs, and update its stored secret. Do not expect the old token to become valid again.
The API request was rejected
For automated fine-grained PAT organization revocation, verify that the caller is a GitHub App, that the app has the organization’s Personal access tokens: write permission, and that the request is attempting only to revoke existing access. A successful request returns HTTP 204.
A leaked token still appears in repository history
History cleanup reduces future exposure but does not neutralize the credential. Confirm that the credential-revocation request succeeded, rotate dependent secrets, then perform repository or log sanitization according to your retention and incident-response policy.
Free tools Windows power users keep installed
One-click scans. No signup required.
A replacement token works in one place but not another
Compare repository selection, permission names, organization approval, SSO state, and expiration between the old and new credentials. Test the exact API or Git operation used by each consumer, because a narrower token may correctly fail operations that the old over-scoped token allowed.
Operational decision guide
| Situation | First action | Follow-up |
|---|---|---|
| Unknown fine-grained PAT with organization access | Organization owner selects it in Active tokens and chooses Revoke | Review the audit event and contact the owner to replace any legitimate workflow |
| Unknown classic PAT | Have the owner revoke or delete it; apply organization or enterprise restrictions | Check SSO and audit records for organization access |
| Unknown OAuth app | User opens Authorized OAuth Apps and chooses Revoke or Revoke all | Investigate the app’s private-repository permissions and reconnect only if justified |
| Credential exposed publicly | Submit the value to the credential-revocation API immediately | Rotate dependent secrets, remove exposed copies, and create a least-privilege replacement |
| Departed employee’s integration | Revoke the user’s tokens and app grants | Transfer ownership, rebuild the integration with an approved identity, and verify failures of the old credentials |
The safest operating rule is simple: inventory by credential type, revoke at the narrowest available scope, verify through logs and an authentication test, and rebuild only what still has a documented need.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
