Skip to main content
Version: 0.8

GitHub

TokenTimer uses the GitHub REST API v3 to discover repository secrets, deploy keys, and SSH keys across your GitHub repositories.

Supported: github.com or GitHub Enterprise Server.

Credential setup​

Classic token​

  1. Go to github.com/settings/tokens/new (or GitHub Settings → Developer Settings → Personal access tokens → Tokens (classic))
  2. Select the repo scope (full repository access)
  3. Optional: read:public_key or admin:public_key (required only if scanning user SSH keys)
  4. Click Generate token
  1. Go to github.com/settings/personal-access-tokens/new (or GitHub Settings → Developer Settings → Fine-grained tokens)
  2. Select the repositories you want to scan
  3. Repository permissions (required):
    • Secrets: Read-only (for repository secrets)
    • Administration: Read-only (for deploy keys)
    • Metadata: Read-only (for repositories)
  4. Account permissions (optional, only if scanning user SSH keys):
    • Git SSH keys: Read-only (required if you enable the "SSH Keys (user only)" filter; scans SSH authentication keys)
    • SSH signing keys: Read-only (currently not scanned; SSH commit signing keys are a separate feature)
    • Note: GPG keys are a different permission and not related to SSH
  5. Click Generate token

Permissions required​

Classic token:

  • repo — access to secrets and deploy keys
  • read:public_key — (optional) for user SSH keys

Fine-grained token:

  • Secrets (Read) — repository secrets
  • Administration (Read) — deploy keys
  • Metadata (Read) — repository info

What is discovered​

  • SSH/GPG keys: title, creation date
  • Repository secrets (Actions): name, repository, last updated
  • Deploy keys: title, repository, read-only status
info

GitHub does not expose expiration dates for these items via its API, so they are imported as Never expires (2099-12-31). You can set expiration dates manually after import. See Expiration dates.

Auto-Sync​

GitHub is one of two providers (with GitLab) that support scheduled re-scans on self-hosted TokenTimer. Instead of running a manual scan every time, you can save the credential once; TokenTimer encrypts it at rest and a background worker re-scans on a cron schedule, importing new and updated tokens automatically.

  • Set up auto-sync from the integration's scan modal by choosing a schedule and saving the credential; TokenTimer encrypts it before storing.
  • The scan frequency and worker behavior are controlled by WORKER_AUTO_SYNC_CRON (Docker Compose) or the auto-sync CronJob schedule (Helm). See Worker scheduling.
  • Every create, update, delete, manual trigger, and failure of an auto-sync configuration is recorded as an AUTO_SYNC_* audit event (AUTO_SYNC_CREATED, AUTO_SYNC_UPDATED, AUTO_SYNC_DELETED, AUTO_SYNC_TRIGGERED, AUTO_SYNC_FAILED). See Auto-Sync events.
  • This is not available on TokenTimer Cloud, which never stores integration credentials.