> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect GitHub with Personal Access Token (GHE.com) – StackOne Hub

> Link a GitHub account in the StackOne Hub using Personal Access Token (GHE.com). End-user guide to authorize the integration and start using GitHub actions.

> [!WARNING]
>
> Use a classic token from a managed user. GitHub limits the setup user (username ending in `_admin`) to single sign-on and SCIM setup. Classic tokens must be allowed in the enterprise's **Policies** > **Personal access tokens** > **Tokens (classic)**, or in each organization's **Settings** > **Personal access tokens** > **Settings** when the enterprise leaves it to organizations. If your enterprise uses an IP allow list, it must allow [StackOne's IP addresses](https://docs.stackone.com/connect/troubleshooting.md#connection-issues-behind-a-firewall). If your identity provider's Conditional Access policy limits IP addresses, it must allow them too.

Select Actions to adjust the guideSome actions may require additional configuration in the provider to be accessible. Choose the actions you need and the guide will be updated.

Select all
Clear

ActionScope(s)

Loading actions...No actions match your search.

Dynamic Guide URL

Copy URL

Scopes Selected

<pre role="textbox" aria-readonly="true" tabIndex="0" />

Separator

Copy scopes

## Find your GHE.com subdomain

The **GHE.com subdomain** is the part before `.ghe.com` in your enterprise's address.

<ul>
  <li>Format: `https://<subdomain>.ghe.com`</li>
  <li>Example: if your address is `https://acme.ghe.com`, your subdomain is `acme`</li>
</ul>

## Create a personal access token (classic)

Create the token as a managed user who owns each organization StackOne should read. To list the whole enterprise, use a managed enterprise owner who also owns those organizations.

**1. Name the token and set an expiration**

Sign in to `https://<subdomain>.ghe.com`, then open **Settings** > **Developer settings** > **Personal access tokens** > **Tokens (classic)**.

<ul>
  <li>Click **Generate new token**.</li>
  <li>Select **Generate new token (classic)**.</li>
  <li>**Note**: `StackOne`</li>
  <li>**Expiration**: a period that fits your rotation policy</li>
</ul>

**2. Select scopes for user access reviews**

Enables actions: Check Organization Membership, Get Authenticated User, Get Organization, Get Organization Membership, Get Team, Get Unified Group, Get Unified Organization, Get Unified User, Get User, List Authenticated User Organization Memberships, List Authenticated User Organizations, List Collaborators, List Organization Audit Log, List Organization Members, List Organization Members With Two-Factor Status, List Outside Collaborators, List Team Members, List Team Repositories, List Teams, List Unified Groups, List Unified Organizations, List Unified Users, List User Organizations, List Users

Select each scope listed.

<ul>
  <li>
    read:org
  </li>

  <li>
    read:user
  </li>

  <li>
    read:enterprise
  </li>
</ul>

**3. Add scopes for compliance checks**

Enables actions: Add Collaborator, Add Team Member, Add Team Repository, Cancel Workflow Run, Check Organization Membership, Create Deployment, Create Deployment Status, Create Git Reference, Create Issue, Create Issue Comment, Create Or Update File, Create Organization Repository, Create Pull Request, Create Pull Request Review, Create Pull Request Review Comment, Create Release, Create Team, Create User Repository, Delete Deployment, Delete File, Delete Git Reference, Delete Release, Delete Team, Download Artifact, Fork Repository, Get Branch, Get Branch Protection, Get Branch Rules, Get Combined Status For Ref, Get Commit, Get Git Reference, Get Issue, Get Latest Release, Get Organization, Get Organization Membership, Get Organization Ruleset, Get Pull Request, Get Repository, Get Repository Content, Get Repository Ruleset, Get Team, Get Workflow Run, List Artifacts, List Authenticated User Organizations, List Authenticated User Repositories, List Branches, List Check Runs For Ref, List Code Scanning Alerts, List Collaborators, List Commits, List Dependabot Alerts, List Deployments, List Enterprise Audit Log, List Forks, List Issue Comments, List Issues, List Matching Git References, List Organization Audit Log, List Organization Branch Protection, List Organization Members, List Organization Members With Two-Factor Status, List Organization Repositories, List Organization Rulesets, List Outside Collaborators, List Pull Request Reviews, List Pull Requests, List Pull Requests For Commit, List Releases, List Repository Rulesets, List Repository Teams, List Secret Scanning Alerts, List Team Members, List Team Repositories, List Teams, List User Organizations, List Workflow Jobs, List Workflow Runs, Merge Pull Request, Re-run Workflow, Remove Collaborator, Remove Organization Member, Remove Team Member, Search Code, Search Issues, Search Pull Requests With Reviews, Search Repositories, Star Repository, Trigger Workflow, Unstar Repository, Update Code Scanning Alert, Update Dependabot Alert, Update Git Reference, Update Issue, Update Organization, Update Pull Request, Update Release, Update Repository, Update Secret Scanning Alert, Update Team

**admin:org** adds organization rulesets. **repo** reads private repositories, pull requests, reviews, branch protection and collaborators. **read:audit\_log** reads the organization audit log for an organization owner and the enterprise audit log for an enterprise owner.

<ul>
  <li>
    admin:org
  </li>

  <li>
    repo
  </li>

  <li>
    read:audit\_log
  </li>
</ul>

**4. Add scopes for other actions**

Enables actions: Create Deployment, Create Deployment Status, Create Webhook, Delete Deployment, Delete Repository, Delete Webhook, Get Authenticated User, Get Webhook, List Code Scanning Alerts, List Dependabot Alerts, List Deployments, List Secret Scanning Alerts, List Webhooks, Ping Webhook, Update Code Scanning Alert, Update Dependabot Alert, Update Secret Scanning Alert, Update User, Update Webhook

Add only the scopes your actions need. If you selected **repo**, it already includes **repo\_deployment** and **security\_events**.

<ul>
  <li>
    repo\_deployment
  </li>

  <li>
    security\_events
  </li>

  <li>
    read:repo\_hook
  </li>

  <li>
    write:repo\_hook
  </li>

  <li>
    admin:repo\_hook
  </li>

  <li>
    user
  </li>

  <li>
    delete\_repo
  </li>
</ul>

**5. Generate the token**

Scroll to the bottom of the form.

<ul>
  <li>Click **Generate token**.</li>
</ul>

**6. Copy the token**

GitHub shows the new token on the page that opens.

<ul>
  <li>Copy the token across. GitHub shows it only once.</li>
</ul>

**7. Authorize the token for single sign-on**

If a **Configure SSO** button appears next to the token, authorize it. Otherwise skip this step.

<ul>
  <li>Click **Configure SSO**.</li>
  <li>Click **Authorize** next to your enterprise or each organization.</li>
</ul>

## Find your organization ID

The **Organization ID** is the organization name in your organization's address on GHE.com.

<ul>
  <li>Format: `https://<subdomain>.ghe.com/<organization ID>`</li>
  <li>Example: if the organization's address is `https://acme.ghe.com/acme-engineering`, the organization ID is `acme-engineering`</li>
</ul>

## Find your enterprise slug

The **Enterprise slug** is the last part of your enterprise's address, usually the same as your subdomain.

<ul>
  <li>Format: `https://<subdomain>.ghe.com/enterprises/<enterprise slug>`</li>
  <li>Example: if the enterprise's address is `https://acme.ghe.com/enterprises/acme`, the enterprise slug is `acme`</li>
  <li>A user appears once they sign in or join an organization. Enterprise members who never signed in and belong to no organization are not listed.</li>
  <li>Someone whose only tie is a pending organization invitation shows as pending.</li>
</ul>

## What GitHub reports for managed users

Managed users sign in and use two-factor authentication through your identity provider, so the two-factor status GitHub shows for them is always off.

## Link the Account

**1. Connect**

<ul>
  <li>Click **Connect**.</li>
  <li>If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider's authorization flow.</li>
  <li>Once authorization is successful, you will see a confirmation popup.</li>
</ul>

**2. Use Actions**

Connect an AI platform to the linked account's actions. See [AI Platforms](https://docs.stackone.com/connect/ai-platforms/overview.md).

Other ways to call actions are listed in [Protocols & SDKs](https://docs.stackone.com/connect/protocols-and-sdks.md).

## Next Steps

> [card] [Webhooks setup](https://docs.stackone.com/connectors/github/guides/webhook-setup.md)
>
> Configure receiving Events for GitHub into StackOne.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.