Skip to main content
Owner privileges in your GitHub organization are required to generate a Personal Access Token with organization-level permissions.

​
Generating a Personal Access Token

Create a Personal Access Token to enable API access with your GitHub account.

1

Access Developer Settings

Sign in to your GitHub account and navigate to developer settings.

  • Click your profile photo in the upper-right corner
  • Select Settings from the dropdown
  • In the left sidebar, scroll down and click Developer settings
2

Navigate to Personal Access Tokens

Access the Personal Access Tokens settings.

  • In the left sidebar, click Personal access tokens
  • Select Tokens (classic) from the dropdown
3

Generate New Token

Create a new classic personal access token.

  • Click the Generate new token dropdown
  • Select Generate new token (classic)
  • Enter a descriptive Note for the token (e.g., StackOne Integration)
4

Set Token Expiration

Configure the token expiration period.

  • Select No expiration from the Expiration dropdown for long-term use
  • Note: For security, consider using a shorter expiration period and rotating tokens regularly
5

Select Required Scopes

Enables actions: Add Collaborator, Add Team Member, Add Team Repository, Cancel Workflow Run, Check Organization Membership, Create Deployment, Create Deployment Status, Create Git Reference, Create Issue, Create Issue Comment, Create Or Update File, Create Organization Repository, Create Pull Request, Create Pull Request Review, Create Pull Request Review Comment, Create Release, Create Team, Create User Repository, Create Webhook, Delete Deployment, Delete File, Delete Git Reference, Delete Release, Delete Repository, Delete Team, Delete Webhook, Download Artifact, Fork Repository, Get Authenticated User, Get Branch, Get Branch Protection, Get Branch Rules, Get Combined Status For Ref, Get Commit, Get Git Reference, Get Issue, Get Latest Release, Get Organization, Get Organization Membership, Get Organization Ruleset, Get Pull Request, Get Repository, Get Repository Content, Get Repository Ruleset, Get Team, Get Unified Group, Get Unified Organization, Get Unified User, Get User, Get Webhook, Get Workflow Run, Invite Organization Member, List Artifacts, List Authenticated User Organization Memberships, List Authenticated User Organizations, List Authenticated User Repositories, List Branches, List Check Runs For Ref, List Code Scanning Alerts, List Collaborators, List Commits, List Dependabot Alerts, List Deployments, List Enterprise Audit Log, List Forks, List Issue Comments, List Issues, List Matching Git References, List Organization Audit Log, List Organization Branch Protection, List Organization Members, List Organization Members With Two-Factor Status, List Organization Repositories, List Organization Rulesets, List Outside Collaborators, List Pull Request Reviews, List Pull Requests, List Pull Requests For Commit, List Releases, List Repository Rulesets, List Repository Teams, List Secret Scanning Alerts, List Team Members, List Team Repositories, List Teams, List Unified Groups, List Unified Organizations, List Unified Users, List User Organizations, List User Repositories, List Users, List Webhooks, List Workflow Jobs, List Workflow Runs, Merge Pull Request, Ping Webhook, Re-run Workflow, Remove Collaborator, Remove Organization Member, Remove Team Member, Search Code, Search Issues, Search Pull Requests With Reviews, Search Repositories, Star Repository, Trigger Workflow, Unstar Repository, Update Code Scanning Alert, Update Dependabot Alert, Update Git Reference, Update Issue, Update Organization, Update Pull Request, Update Release, Update Repository, Update Secret Scanning Alert, Update Team, Update User, Update Webhook, Upload Release Asset

Choose the appropriate Classic OAuth scopes for your integration needs. The scopes below match the exact structure and grouping from GitHub’s token creation page.

6

Scopes for access reviews and compliance checks

Enables actions: Add Collaborator, Add Team Member, Add Team Repository, Check Organization Membership, Create Deployment, Create Deployment Status, Create Git Reference, Create Issue, Create Issue Comment, Create Or Update File, Create Organization Repository, Create Pull Request, Create Pull Request Review, Create Pull Request Review Comment, Create Release, Create Team, Create User Repository, Delete Deployment, Delete File, Delete Git Reference, Delete Release, Delete Team, Fork Repository, Get Branch, Get Branch Protection, Get Branch Rules, Get Combined Status For Ref, Get Commit, Get Git Reference, Get Issue, Get Latest Release, Get Organization, Get Organization Membership, Get Organization Ruleset, Get Pull Request, Get Repository, Get Repository Content, Get Repository Ruleset, Get Team, Get Unified Group, Get Unified Organization, Invite Organization Member, List Authenticated User Organization Memberships, List Authenticated User Organizations, List Authenticated User Repositories, List Branches, List Check Runs For Ref, List Code Scanning Alerts, List Collaborators, List Commits, List Dependabot Alerts, List Deployments, List Enterprise Audit Log, List Forks, List Issue Comments, List Issues, List Matching Git References, List Organization Audit Log, List Organization Branch Protection, List Organization Members, List Organization Members With Two-Factor Status, List Organization Repositories, List Organization Rulesets, List Outside Collaborators, List Pull Request Reviews, List Pull Requests, List Pull Requests For Commit, List Releases, List Repository Rulesets, List Repository Teams, List Secret Scanning Alerts, List Team Members, List Team Repositories, List Teams, List Unified Groups, List Unified Organizations, List Unified Users, List User Organizations, Merge Pull Request, Remove Collaborator, Remove Organization Member, Remove Team Member, Search Code, Search Issues, Search Pull Requests With Reviews, Search Repositories, Star Repository, Trigger Workflow, Unstar Repository, Update Code Scanning Alert, Update Dependabot Alert, Update Git Reference, Update Issue, Update Organization, Update Pull Request, Update Release, Update Repository, Update Secret Scanning Alert, Update Team, Upload Release Asset

read:org lists members and teams, two-factor status when the token’s user owns the organization, and the organization audit log for an owner. admin:org adds pending invitations, the organization’s two-factor requirement and organization rulesets. repo reads private repositories, pull requests, reviews, branch protection and collaborators. read:audit_log reads the enterprise audit log for an enterprise owner.

7

Generate and Copy Token

Complete the token generation and store it securely.

  • Scroll to the bottom and click Generate token
  • Copy the displayed token immediately and store it securely
  • Warning: The token is shown only once and cannot be retrieved later
  • Format: ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
8

Authorize the token for single sign-on

If your organization uses SAML single sign-on, GitHub refuses its requests with 403 until the token is authorized for it.

  • Go to Settings > Developer settings > Personal access tokens > Tokens (classic)
  • Next to the token, click Configure SSO, then Authorize next to the organization

​
Connecting a GitHub Enterprise Cloud enterprise

Fill in Enterprise slug to list every licensed user in the enterprise across all its organizations. Leave it empty to list one organization at a time.

1

Create the token as an enterprise owner

An enterprise owner creates a classic token with the steps above. GitHub Apps cannot read the enterprise’s users, so this needs the token connection.

  • Enterprise Managed Users: sign in through your identity provider as a managed enterprise owner (username ending in _<shortcode>). Do not use the <shortcode>_admin setup user
  • To read an organization’s members, teams and settings, the token’s user must also be an owner of that organization. An enterprise owner who is not a member of an organization does not see it
2

Select the read-only scopes

Enables actions: Check Organization Membership, Get Authenticated User, Get Organization, Get Organization Membership, Get Team, Get Unified Group, Get Unified Organization, Get Unified User, Get User, List Authenticated User Organization Memberships, List Authenticated User Organizations, List Collaborators, List Organization Audit Log, List Organization Members, List Organization Members With Two-Factor Status, List Outside Collaborators, List Team Members, List Team Repositories, List Teams, List Unified Groups, List Unified Organizations, List Unified Users, List User Organizations, List Users

In the enterprise list, someone whose only tie is a pending organization invitation shows as pending. Add admin:org only if you also list single organizations and want all their pending invitations.

3

Authorize the token for single sign-on

If your enterprise or organizations use SAML or OIDC single sign-on, including Enterprise Managed Users, authorize the token. Until then GitHub refuses organization requests.

  • Go to Settings > Developer settings > Personal access tokens > Tokens (classic)
  • Next to the token, click Configure SSO, then Authorize for your enterprise or each organization
4

Enter the enterprise

In Enterprise slug, enter the last part of https://github.com/enterprises/<enterprise slug>.

  • A user appears once they sign in or join an organization. Enterprise members who never signed in and belong to no organization are not listed
  • Enterprise Managed Users: two-factor status shows as unknown and email addresses are empty, because sign-in and email are managed in your identity provider
5

Check enterprise policies

Confirm nothing blocks the connection.

  • If the enterprise restricts classic tokens (Policies > Personal access tokens), allow them for the connecting owner
  • If an IP allow list is on (Settings > Authentication security), add StackOne’s IP addresses

​
Linking the Account from the Hub

1

Navigate to the Hub

Use one of the three Linking Account Methods to access the Hub.
2

Fill out the fields

Fill out the following fields using details from your provider:
  • Personal Access Token
  • Organization ID (Optional)
  • Enterprise slug (Optional)
3

Connect

  • Click Connect
  • If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider’s authorization flow.
  • Once authorization is successful, you will see a confirmation popup

If the account linking is successful, you will see the newly linked account in your Accounts page.

​
Next Steps

Webhooks setup

Configure receiving Events for GitHub into StackOne.