--- title: Automate SSO authorization for classic PATs and SSH keys description: GitHub Enterprise Cloud admins can now automate SSO authorization for existing classic personal access tokens and SSH keys instead of manually authorizing... canonical: https://daily.dev/posts/automate-sso-authorization-for-classic-pats-and-ssh-keys-b4pmx6xnw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Automate SSO authorization for classic PATs and SSH keys | daily.dev og:description: GitHub Enterprise Cloud admins can now automate SSO authorization for existing classic personal access tokens and SSH keys instead of manually authorizing... og:url: https://daily.dev/posts/automate-sso-authorization-for-classic-pats-and-ssh-keys-b4pmx6xnw og:image: https://api.daily.dev/og/posts/b4Pmx6xNW.png og:image:alt: Automate SSO authorization for classic PATs and SSH keys og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Automate SSO authorization for classic PATs and SSH keys **[GitHub Changelog](https://daily.dev/sources/github_updates)** · 2 min read · 0 upvotes · 0 comments ## Summary GitHub Enterprise Cloud admins can now automate SSO authorization for existing classic personal access tokens and SSH keys instead of manually authorizing credentials per organization. Enterprise-installed GitHub Apps with the enterprise_credentials:write permission can call a new API to bulk-authorize a PAT or SSH key across up to 50 organizations in one request. The API identifies credentials by non-secret token ID or fingerprint, verifies organization membership and enterprise SSO usage, and skips organizations that already have active authorization. This targets service accounts and automation credentials that previously required manual per-organization rotation, which often led to overuse of long-lived tokens. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I automate SSO authorization for classic personal access tokens across multiple GitHub organizations? GitHub Enterprise Cloud admins can now enable a new enterprise setting allowing credential delegation through enterprise-installed GitHub Apps with the enterprise_credentials:write permission. These apps call a new API to bulk-authorize a classic PAT or SSH key for up to 50 organizations in one request, identifying credentials by non-secret token ID or fingerprint rather than the secret itself. _Teams automating credential rotation at scale can track GitHub platform changes like this via daily.dev._ ### Why do enterprises end up using long-lived GitHub tokens instead of rotating them regularly? Manually authorizing credentials one organization at a time across multiple SSO-protected organizations creates friction and overhead, which pushes teams toward long-lived tokens to avoid repeated rotation work. GitHub Enterprise Cloud now addresses this by letting a GitHub App bulk-authorize a token or SSH key for up to 50 organizations whenever it is rotated or new organizations are added. _Anyone weighing token rotation practices against operational overhead can follow platform updates like this on daily.dev._ ## Similar posts on daily.dev - [GitHub ships break glass credential revocation](https://daily.dev/posts/github-ships-break-glass-credential-revocation-cii7k9djr) · Aikido Security · 0 upvotes · 0 comments - [Credential revocation and deauthorization by token type](https://daily.dev/posts/credential-revocation-and-deauthorization-by-token-type-kkg8ba6sd) · GitHub Changelog · 0 upvotes · 0 comments - [Enterprise-wide credential management tools for incident response](https://daily.dev/posts/enterprise-wide-credential-management-tools-for-incident-response-o4y8yihch) · GitHub Changelog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#authentication](https://daily.dev/tags/authentication) [View this post on daily.dev](https://daily.dev/posts/automate-sso-authorization-for-classic-pats-and-ssh-keys-b4pmx6xnw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Automate SSO authorization for classic PATs and SSH keys","url":"https://daily.dev/posts/automate-sso-authorization-for-classic-pats-and-ssh-keys-b4pmx6xnw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/automate-sso-authorization-for-classic-pats-and-ssh-keys-b4pmx6xnw"},"datePublished":"2026-09-16T21:21:58.558Z","dateModified":"2026-09-16T22:25:22.903Z","description":"GitHub Enterprise Cloud admins can now automate SSO authorization for existing classic personal access tokens and SSH keys instead of manually authorizing...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7e8577c6287118db52aacbd83e810ab9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7e8577c6287118db52aacbd83e810ab9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"GitHub Changelog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitHub Changelog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/15004b7835da4d89b02b115871f0f6dc","url":"https://daily.dev/sources/github_updates"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/automate-sso-authorization-for-classic-pats-and-ssh-keys-b4pmx6xnw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,github,authentication","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitHub Changelog","item":"https://daily.dev/sources/github_updates"},{"@type":"ListItem","position":3,"name":"Automate SSO authorization for classic PATs and SSH keys"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/automate-sso-authorization-for-classic-pats-and-ssh-keys-b4pmx6xnw#faq","mainEntity":[{"@type":"Question","name":"How can I automate SSO authorization for classic personal access tokens across multiple GitHub organizations?","acceptedAnswer":{"@type":"Answer","text":"GitHub Enterprise Cloud admins can now enable a new enterprise setting allowing credential delegation through enterprise-installed GitHub Apps with the enterprise_credentials:write permission. These apps call a new API to bulk-authorize a classic PAT or SSH key for up to 50 organizations in one request, identifying credentials by non-secret token ID or fingerprint rather than the secret itself. Teams automating credential rotation at scale can track GitHub platform changes like this via daily.dev."}},{"@type":"Question","name":"Why do enterprises end up using long-lived GitHub tokens instead of rotating them regularly?","acceptedAnswer":{"@type":"Answer","text":"Manually authorizing credentials one organization at a time across multiple SSO-protected organizations creates friction and overhead, which pushes teams toward long-lived tokens to avoid repeated rotation work. GitHub Enterprise Cloud now addresses this by letting a GitHub App bulk-authorize a token or SSH key for up to 50 organizations whenever it is rotated or new organizations are added. Anyone weighing token rotation practices against operational overhead can follow platform updates like this on daily.dev."}}]} ```