--- title: Credential revocation and deauthorization by token type description: GitHub Enterprise Cloud now supports token-type-specific credential revocation and deauthorization, letting enterprise owners, org admins, and users with the... canonical: https://daily.dev/posts/credential-revocation-and-deauthorization-by-token-type-kkg8ba6sd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Credential revocation and deauthorization by token type | daily.dev og:description: GitHub Enterprise Cloud now supports token-type-specific credential revocation and deauthorization, letting enterprise owners, org admins, and users with the... og:url: https://daily.dev/posts/credential-revocation-and-deauthorization-by-token-type-kkg8ba6sd og:image: https://api.daily.dev/og/posts/kkG8bA6SD.png og:image:alt: Credential revocation and deauthorization by token type og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Credential revocation and deauthorization by token type **[GitHub Changelog](https://daily.dev/sources/github_updates)** · 2 min read · 0 upvotes · 0 comments ## Summary GitHub Enterprise Cloud now supports token-type-specific credential revocation and deauthorization, letting enterprise owners, org admins, and users with the Manage enterprise credentials permission revoke or deauthorize a single credential type (personal access tokens, SSH keys, OAuth app tokens, or GitHub App user access tokens) instead of all a user's credentials at once. The feature is available both at enterprise and organization level, through the UI and REST APIs, and all actions are logged in the audit log with email notifications to affected users. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I revoke only personal access tokens for a GitHub user without affecting their SSH keys? GitHub now supports token-type-specific bulk revocation, letting enterprise owners, organization admins, or users with the Manage enterprise credentials permission delete or revoke all credentials of a single type—such as personal access tokens—for a specific user without touching other credential types like SSH keys, OAuth app tokens, or GitHub App user access tokens. This works through the UI or enterprise and organization REST APIs. _Teams handling account compromises can follow credential security changes like this one on daily.dev._ ### Is bulk credential revocation available at the organization level on GitHub, not just enterprise level? Yes, all bulk credential-revocation actions previously limited to the enterprise level are now also available at the organization level, through both the web UI and the organization REST APIs. This enables organization admins to independently run incident response actions, such as revoking SSO authorizations or deleting tokens of a specific type, without needing enterprise-level access. _Org admins refining incident response workflows can track GitHub security updates like this via daily.dev._ ## Similar posts on daily.dev - [Self-service credential revocation for incident response](https://daily.dev/posts/self-service-credential-revocation-for-incident-response-q0eqouakt) · GitHub Changelog · 0 upvotes · 0 comments - [GitHub ships break glass credential revocation](https://daily.dev/posts/github-ships-break-glass-credential-revocation-cii7k9djr) · Aikido Security · 0 upvotes · 0 comments - [GitHub Credential Revocation by Token Type: Improving Enterprise Incident Response](https://daily.dev/posts/github-credential-revocation-by-token-type-improving-enterprise-incident-response-v50qgox8i) · C\# Corner · 0 upvotes · 0 comments - [GitHub Enterprise adds credential inventory exports](https://daily.dev/posts/github-enterprise-adds-credential-inventory-exports-kfuczt8ub) · GitHub Changelog · 0 upvotes · 0 comments - [Enterprise-wide credential management tools for incident response](https://daily.dev/posts/enterprise-wide-credential-management-tools-for-incident-response-o4y8yihch) · GitHub Changelog · 0 upvotes · 0 comments --- Tags: [#github](https://daily.dev/tags/github), [#authentication](https://daily.dev/tags/authentication), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/credential-revocation-and-deauthorization-by-token-type-kkg8ba6sd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Credential revocation and deauthorization by token type","url":"https://daily.dev/posts/credential-revocation-and-deauthorization-by-token-type-kkg8ba6sd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/credential-revocation-and-deauthorization-by-token-type-kkg8ba6sd"},"datePublished":"2026-08-18T22:19:32.028Z","dateModified":"2026-09-13T19:07:54.875Z","description":"GitHub Enterprise Cloud now supports token-type-specific credential revocation and deauthorization, letting enterprise owners, org admins, and users with the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/30523f93df742d6867d29d76386070a4?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/30523f93df742d6867d29d76386070a4?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"GitHub Changelog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitHub Changelog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/15004b7835da4d89b02b115871f0f6dc","url":"https://daily.dev/sources/github_updates"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/credential-revocation-and-deauthorization-by-token-type-kkg8ba6sd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"github,authentication,oauth","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitHub Changelog","item":"https://daily.dev/sources/github_updates"},{"@type":"ListItem","position":3,"name":"Credential revocation and deauthorization by token type"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/credential-revocation-and-deauthorization-by-token-type-kkg8ba6sd#faq","mainEntity":[{"@type":"Question","name":"How do I revoke only personal access tokens for a GitHub user without affecting their SSH keys?","acceptedAnswer":{"@type":"Answer","text":"GitHub now supports token-type-specific bulk revocation, letting enterprise owners, organization admins, or users with the Manage enterprise credentials permission delete or revoke all credentials of a single type—such as personal access tokens—for a specific user without touching other credential types like SSH keys, OAuth app tokens, or GitHub App user access tokens. This works through the UI or enterprise and organization REST APIs. Teams handling account compromises can follow credential security changes like this one on daily.dev."}},{"@type":"Question","name":"Is bulk credential revocation available at the organization level on GitHub, not just enterprise level?","acceptedAnswer":{"@type":"Answer","text":"Yes, all bulk credential-revocation actions previously limited to the enterprise level are now also available at the organization level, through both the web UI and the organization REST APIs. This enables organization admins to independently run incident response actions, such as revoking SSO authorizations or deleting tokens of a specific type, without needing enterprise-level access. Org admins refining incident response workflows can track GitHub security updates like this via daily.dev."}}]} ```