GitHub completes stateless App token rollout; integrations must accept longer strings
GitHub said on October 2 that its staged rollout of stateless GitHub App installation tokens was complete. Newly minted installation tokens use the stateless format by default. This is an installation-token change, not a blanket change to every GitHub credential type.
The tokens retain the ghs_ prefix but are now about 520 characters long rather than 40. Integrations that assume a fixed legacy length can truncate or reject them. GitHub recommends treating tokens as opaque strings instead of parsing their internal format.
Token permissions, repository scoping, the one-hour expiration and the installation access token REST API endpoint are unchanged. Tokens minted before the change continue working until they expire. The longer string does not grant broader access or extend its lifetime.
The rollout began on April 27. GitHub says stateless tokens make issuance and validation faster and improve API reliability. Those are platform claims, not a measured performance guarantee for every integration or a change to API rate limits.
The temporary X-GitHub-Stateless-S2S-Token request header will be deprecated on November 30, 2026. GitHub says it will no longer respect that header afterward and eligible apps will always receive stateless tokens. The notice asks developers to validate both formats before removing the temporary header from production code.
Teams should check fixed-length validation, database columns, secret stores, environment limits, authorization-header handling and redaction rules. A workflow that successfully minted an old token may still fail when a longer token passes through middleware. This update does not require publishing token values or weakening permission boundaries.