GitHub Actions · OAuth Scopes

GitHub Actions OAuth Scopes

OAuth 2.0 searched

GitHub Actions uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

Scopes: 0 Flows: Method: searched

Scopes (0)

GitHub Actions implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

📄 Provider scope reference: https://docs.github.com/en/rest/authentication/permissions-required-for-fine-grained-personal-access-tokens

Source

OAuth Scopes

Raw ↑ 
generated: '2026-06-20'
method: searched
source: >-
  https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps
  and https://docs.github.com/en/rest/authentication/permissions-required-for-fine-grained-personal-access-tokens
docs: https://docs.github.com/en/rest/authentication/permissions-required-for-fine-grained-personal-access-tokens
description: >-
  The OpenAPI declares http-bearer auth without oauth2 flow objects, so scopes
  are captured from the GitHub docs. GitHub exposes two parallel authorization
  models: classic OAuth scopes (coarse) and fine-grained token / GitHub App
  permissions (per-resource read|write). Both relevant to the Actions API are
  listed here.
oauth_scopes:
  - {scope: repo, description: Full control of private repositories, including workflow runs, artifacts, secrets and variables in private repos.}
  - {scope: workflow, description: Grants the ability to add and update GitHub Actions workflow files. Required to push .github/workflows changes.}
  - {scope: 'admin:org', description: Manage org-level Actions settings, org secrets/variables, runner groups and self-hosted runners.}
  - {scope: 'read:org', description: Read org membership and org-level Actions configuration.}
fine_grained_permissions:
  - {permission: actions, access: 'read|write', description: 'Workflows, workflow runs, artifacts, caches, job logs and run reruns. Write manages run state and artifacts.'}
  - {permission: secrets, access: 'read|write', description: Repository-level Actions secrets (list metadata / create-update-delete).}
  - {permission: variables, access: 'read|write', description: Repository-level Actions variables.}
  - {permission: environments, access: 'read|write', description: Deployment environments, environment secrets and variables, protection rules.}
  - {permission: administration, access: 'read|write', description: 'Actions permissions/policy, cache limits, self-hosted runner registration and OIDC subject-claim customization.'}
  - {permission: organization_secrets, access: 'read|write', description: Organization Actions secrets.}
  - {permission: organization_self_hosted_runners, access: 'read|write', description: Organization self-hosted runners and runner groups.}
notes:
  - GITHUB_TOKEN (the automatic token inside a workflow run) is governed by the workflow's `permissions:` block, which maps onto these fine-grained permissions.