Skip to main content

GitHub

TokenTimer uses the GitHub REST API v3 to discover repository secrets, deploy keys, and SSH keys across your GitHub repositories.

Supported: github.com or GitHub Enterprise Server.

Credential setup​

Classic token​

  1. Go to github.com/settings/tokens/new (or GitHub Settings → Developer Settings → Personal access tokens → Tokens (classic))
  2. Select the repo scope (full repository access)
  3. Optional: read:public_key or admin:public_key (required only if scanning user SSH keys)
  4. Click Generate token
  1. Go to github.com/settings/personal-access-tokens/new (or GitHub Settings → Developer Settings → Fine-grained tokens)
  2. Select the repositories you want to scan
  3. Repository permissions (required):
    • Secrets: Read-only (for repository secrets)
    • Administration: Read-only (for deploy keys)
    • Metadata: Read-only (for repositories)
  4. Account permissions (optional, only if scanning user SSH keys):
    • Git SSH keys: Read-only (required if you enable the "SSH Keys (user only)" filter; scans SSH authentication keys)
    • SSH signing keys: Read-only (currently not scanned; SSH commit signing keys are a separate feature)
    • Note: GPG keys are a different permission and not related to SSH
  5. Click Generate token

Permissions required​

Classic token:

  • repo — access to secrets and deploy keys
  • read:public_key — (optional) for user SSH keys

Fine-grained token:

  • Secrets (Read) — repository secrets
  • Administration (Read) — deploy keys
  • Metadata (Read) — repository info

What is discovered​

  • SSH/GPG keys: title, creation date
  • Repository secrets (Actions): name, repository, last updated
  • Deploy keys: title, repository, read-only status
info

GitHub does not expose expiration dates for these items via its API, so they are imported as Never expires (2099-12-31). You can set expiration dates manually after import. See Expiration dates.

Scan filters​

  • Item types: select SSH keys, repository secrets, or deploy keys
  • Filter rules: optional include/exclude rules (exact or regex, on name or description) applied to the scan preview and the import. See Filter rules.
  • Remove obsolete tokens: opt-in cleanup that deletes previously imported tokens no longer found at the source. See Obsolete-token cleanup.

GitHub Enterprise behind an allowlist​

If your GitHub Enterprise Server restricts inbound traffic by IP, allow TokenTimer Cloud's egress IP. See Egress IP allowlisting.