[CRED-2815] Document PAT/SAT scope, TTL, and app-key restrictions#38326
Draft
emubello wants to merge 2 commits into
Draft
[CRED-2815] Document PAT/SAT scope, TTL, and app-key restrictions#38326emubello wants to merge 2 commits into
emubello wants to merge 2 commits into
Conversation
Add a Restrictions section to the Personal Access Tokens and Service Access Tokens pages describing the new containment rules: PATs/SATs cannot create or update application keys, cannot mint or update another PAT/SAT with broader scopes than their own, and cannot create a PAT/SAT with a longer TTL than their own.
Contributor
Preview links (active after the
|
tyjet
reviewed
Jul 20, 2026
|
|
||
| - **Application keys**: A PAT cannot create or update application keys. Revoking application keys is still allowed. | ||
| - **Scopes on new tokens**: A PAT can create or update another PAT or a SAT only if the new token's scopes are a subset of its own scopes. | ||
| - **Time-to-live (TTL) on new tokens**: A PAT cannot create a PAT or a SAT with a TTL that outlives itself. |
There was a problem hiding this comment.
question (blocking): My interpretation of this is that if my PAT is expiring and I want to mint a new PAT for myself, I cannot use the expiring PAT to do so. Is this correct.
Contributor
There was a problem hiding this comment.
This is why having a "rotate" endpoint would be useful. WDTY @tyjet?
tyjet
approved these changes
Jul 20, 2026
anthony-dgx
reviewed
Jul 21, 2026
anthony-dgx
reviewed
Jul 21, 2026
A SAT cannot create a PAT, since PAT creation is always scoped to the authenticated caller. Remove that language from the SAT restrictions section.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do? What is the motivation?
Adds a Restrictions section to the Personal Access Tokens and Service Access Tokens pages documenting new containment rules for API calls authenticated with a PAT or SAT:
Calls that violate these restrictions return a
403 Forbiddenresponse.