# GitHub Apps gain narrow repository-creation permissions and safer installation automation GitHub's October 13 permissions update lets Apps and fine-grained PATs create repositories without broad administration rights and manage which repositories an approved App can access. It also adds a staged path back to expiring GitHub App user tokens. GitHub Apps no longer need repository-administration permission just to create repositories. New fine-grained installation controls and token-rotation support reduce the privilege required for integration automation. - Status: Active - Published: 2026-10-14T21:15:48+13:00 - Updated: 2026-10-14T21:15:48+13:00 - Categories: Web Development, Cloud & Infrastructure, Deployment & DevOps, Developer Tools - Tags: API security, Authentication, Coding agents, GitHub - Canonical HTML: https://beyondthe.news/dossiers/github-apps-fine-grained-repository-creation-installation-permissions-october-2026 ## What changed On October 13, 2026, GitHub introduced two repository-level fine-grained permissions for GitHub Apps and fine-grained personal access tokens. `repository_creation:write` allows repository creation without `repository_administration:write`, which also permits powerful actions such as deletion and transfer. `installation_repositories:write` supports adding or removing repositories from an organisation's existing GitHub App installations through the installation APIs, instead of relying on a classic broad `repo` token. Repository admins may add repositories to an already organisation-approved App without fresh organisation-owner approval, subject to organisation policy. GitHub Apps also support `offline_access` to test and gradually re-enable expiring user access tokens with refresh tokens. ## Why it matters A developer platform, internal tool or coding-agent service often needs to create a project repository or grant an approved App access to one repository, but historically could require credentials with much wider administration authority. Narrower permissions reduce the damage possible if an integration credential is leaked or misused and make least-privilege approvals easier for organisations. This is not a blanket permission to install unapproved Apps or to bypass organisation ownership controls; the new APIs still enforce relevant account and organisation requirements. ## Creating a repository no longer implies permission to delete it Previously, a GitHub App or fine-grained token commonly needed repository administration write access to create a repository, bundling a routine provisioning task with sensitive operations such as deletion and transfer. GitHub now exposes a distinct creation permission. For organisations provisioning repositories through CI, developer portals or agents, that is a concrete reduction in credential blast radius. ## Installation access can be managed without a broad classic token The add/remove installation repository APIs now accept fine-grained GitHub App or PAT credentials with the new installation-repository permission. Repository administrators can extend an App already approved at organisation level to their repository, avoiding unnecessary owner approvals. This does not authorise new organisation-level App installations, and organisations can restrict this delegation. ## Token expiration migration gets a staged path Some GitHub Apps disabled user-token expiration because re-enabling it for every user simultaneously could break clients. With `offline_access`, developers can opt particular authentication flows into expiring access tokens plus refresh tokens, validate their refresh handling and migrate gradually. This reduces a different risk from repository permissions: long-lived credentials. ## Key details - The October 13, 2026 changelog introduces `repository_creation:write` and `installation_repositories:write` for GitHub Apps and fine-grained PATs. - `repository_creation:write` creates repositories without the broad `repository_administration:write` permission that also covers deletion and transfer. - The installation-repository permission lets authorised automation add or remove a repository from an existing App installation; user callers must also be organisation owners or repository administrators. - An App still requires organisation-administrator approval for installation; repo administrators can add repositories only to Apps already approved for that organisation, unless policy restricts this. - `offline_access` enables gradual adoption of short-lived GitHub App user tokens with refresh tokens rather than forcing an all-at-once migration. - The new permissions are separate from classic PAT `repo` scope and should be requested only for workflows that need them. ## Builder takeaways - Audit GitHub App and fine-grained PAT grants used for repository provisioning; replace repository administration with `repository_creation:write` where supported. - For App access automation, evaluate `installation_repositories:write` rather than issuing classic PATs with `repo` scope. - Check whether organisation policies permit repository administrators to extend already-approved installations. - If your GitHub App uses non-expiring user tokens, test `offline_access` refresh handling in a staged rollout before broad enforcement. - Keep separate approvals for organisation-level installation, repository creation and installation membership; they are not interchangeable. ## What to watch - Adoption by developer-platform and coding-agent integrations. - Additional GitHub App fine-grained permissions and changes to approval workflows. - Future enforcement dates or defaults for GitHub App user-token expiration. ## Uncertainties - Existing integrations do not automatically become least-privileged; maintainers must adjust requested permissions and tokens. - The announcement does not quantify how many existing Apps will migrate or the real-world reduction in security incidents. - Organisation-specific restrictions can prevent delegated installation management despite the new default capability. ## Sources - [GitHub App improvements for least privilege and management](https://github.blog/changelog/2026-10-13-github-app-improvements-for-least-privilege-and-management/) — GitHub Changelog · primary announcement · 2026-10-13T00:00:00+13:00. New scopes, organisation/repository approval boundaries, offline_access and credential management. - [REST API endpoints for repositories](https://docs.github.com/en/rest/repos/repos?apiVersion=2026-03-10) — GitHub Docs · primary API documentation. Repository creation endpoint now accepts repository-creation write permission alongside administration. - [REST API endpoints for GitHub App installations](https://docs.github.com/en/rest/apps/installations?apiVersion=2026-03-10) — GitHub Docs · primary API documentation. Installation-repository membership APIs and token requirements.