GitHub is enabling enterprise administrators to automate SSO authorizations for existing classic personal access tokens and SSH keys within GitHub Enterprise Cloud. This removes the need for developers to manually grant approval on a per-organization basis, a process that created friction and extra work across multiple SSO-protected organizations.
The feature is opt-in via a new enterprise capability for credential delegation. When a GitHub App is installed within the enterprise and has the enterprise_credentials:write permission, it can call the new API to approve a token or key for up to fifty organizations in a single request.
The API operates without sharing any secrets of the credentials involved: identification is done via a non-secret token ID or the SSH key’s fingerprint. Before proceeding, the API verifies that each target organization belongs to the relevant enterprise, that the credential owner is a member of each organization, and that enterprise-level SSO is enabled. Existing active authorizations are skipped.
This approach supports managing SSO consents for service accounts and automation credentials during token rotation or when new organizations are added. The capability is available immediately for accounts on GitHub Enterprise Cloud.