How to revoke a gho_* token?

[datosh]

Select Topic Area

Question

Body

I accidentally leaked a token issued for one of my Authorized OAuth Apps. Is there any way (via WebUI or API) to revoke only the specific token, without revoking the whole OAuth App?

The Token expiration and revocation documentation talks about a few options, but none fit here:

1. Tokens are revoked when pushed to a public repo or gist: I don't want to tempt fate and spread my leaked token further.
2. Token revoked by the user: Only explains how to revoke the whole app.
3. Revoke by the app owner: I am just a user.

[gabrielfrimodig]

Navigate to Settings > Applications > Authorized OAuth Apps and from there see a list of authorized tokens and a Revoke option next to it.

[datosh]

I don't see a lit of tokens on that page. Could you provide a link and/or screenshot to guide me there?

When I follow the path you provided it only lists a number of apps, not the individual tokens for each.
I do concede that it is possible to revoke the app, but as specified in my question I would like to only revoke a single for token, not the whole app.

[yashksaini-coder]

You can easily delete a github_token. At the left hand upper corner you will see a Revoke All option that will revoke all the github tokens immediately. It will require user passowrd input.

[datosh]

This page only lists personal access tokens, which are prefixed with ghp_, as documented here.

I am specifically looking for OAuth App tokens which have a gho_ prefix.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[anonymous-leviathan]

Select Topic Area

Question

Body

I accidentally leaked a token issued for one of my Authorized OAuth Apps. Is there any way (via WebUI or API) to revoke only the specific token, without revoking the whole OAuth App?

The Token expiration and revocation documentation talks about a few options, but none fit here:

1. Tokens are revoked when pushed to a public repo or gist: I don't want to tempt fate and spread my leaked token further.
2. Token revoked by the user: Only explains how to revoke the whole app.
3. Revoke by the app owner: I am just a user.

To revoke only a specific OAuth token without revoking access to the entire app, you have a few options depending on the platform's specific API or settings. Here’s a general approach that may work for many OAuth implementations:

1. Use the Platform’s API to Revoke the Token: Some platforms allow users to manage their own OAuth tokens individually. If your OAuth provider offers an API or a Web UI where you can view and manage all issued tokens, you may be able to select and revoke the specific leaked token without affecting other tokens. This is often found in the "Authorized Applications" or "Tokens" section of your account settings.

2. Check with the App Developer or Provider: If the platform doesn't allow token management directly by the user, consider reaching out to their support team or documentation. Some platforms allow app developers to revoke specific tokens or sessions, so if this applies, they may be able to assist.

3. Regenerate or Rotate the Token (If Available): Some platforms allow token regeneration or rotation, which can invalidate the old token and issue a new one without disrupting the entire app’s access. This would ensure that the leaked token is no longer valid.

If the platform does not provide any of these mechanisms, unfortunately, you may need to revoke the entire app’s authorization to ensure that the leaked token cannot be used maliciously. However, if you can share the specific platform (e.g., GitHub, Google, etc.)

if your issue was fixed make this as an answer if it is not we can explore more ways