What changed
On October 13, 2026, GitHub introduced two repository-level fine-grained permissions for GitHub Apps and fine-grained personal access tokens. `repository_creation:write` allows repository creation without `repository_administration:write`, which also permits powerful actions such as deletion and transfer. `installation_repositories:write` supports adding or removing repositories from an organisation's existing GitHub App installations through the installation APIs, instead of relying on a classic broad `repo` token. Repository admins may add repositories to an already organisation-approved App without fresh organisation-owner approval, subject to organisation policy. GitHub Apps also support `offline_access` to test and gradually re-enable expiring user access tokens with refresh tokens.
Why it matters
A developer platform, internal tool or coding-agent service often needs to create a project repository or grant an approved App access to one repository, but historically could require credentials with much wider administration authority. Narrower permissions reduce the damage possible if an integration credential is leaked or misused and make least-privilege approvals easier for organisations. This is not a blanket permission to install unapproved Apps or to bypass organisation ownership controls; the new APIs still enforce relevant account and organisation requirements.
Creating a repository no longer implies permission to delete it
Previously, a GitHub App or fine-grained token commonly needed repository administration write access to create a repository, bundling a routine provisioning task with sensitive operations such as deletion and transfer. GitHub now exposes a distinct creation permission. For organisations provisioning repositories through CI, developer portals or agents, that is a concrete reduction in credential blast radius.
Installation access can be managed without a broad classic token
The add/remove installation repository APIs now accept fine-grained GitHub App or PAT credentials with the new installation-repository permission. Repository administrators can extend an App already approved at organisation level to their repository, avoiding unnecessary owner approvals. This does not authorise new organisation-level App installations, and organisations can restrict this delegation.
Token expiration migration gets a staged path
Some GitHub Apps disabled user-token expiration because re-enabling it for every user simultaneously could break clients. With `offline_access`, developers can opt particular authentication flows into expiring access tokens plus refresh tokens, validate their refresh handling and migrate gradually. This reduces a different risk from repository permissions: long-lived credentials.