Credential ownership · Available on Enterprise Cloud
GitHub Enterprise adds credential inventory exports
Announced September 21, 2026. Sources checked November 9, 2026.
GitHub’s September announcement introduced enterprise credential metadata exports. The current API reference directs automation to asynchronous CSV export and marks the former paginated listing endpoint for removal on October 2, 2026. Inventory records include personal access tokens, app access and user SSH keys, with ownership and lifecycle fields where available; exports contain metadata, not token values.
Who it affects. Enterprise Cloud owners and people with the View enterprise credentials permission. GitHub App installations represent the ability to issue tokens, not every short-lived installation token. CSV rows can repeat a credential for each authorizing organization.
What remains uncertain. The original announcement still describes a paginated API, while the current API reference directs consumers to asynchronous export. We did not test live endpoint availability. Enterprise Server support has no confirmed version or date in these sources. Empty expiry cells can mean unavailable or inapplicable data.
One next step. Ask the enterprise access owner to review an export, confirm who maintains each relevant credential, and assign follow-up for unknown expiry or ownership. Verify dependencies before changing access.
SSH authentication · Upload requirement in effect; brownouts scheduled
Check SSH clients before the December 9 brownout
Announced September 22, 2026. Sources checked November 9, 2026.
The October 14 minimum of 3072 bits for new RSA authentication and signing key uploads remains in effect. The November 4 SSH brownout date has passed; GitHub schedules another on December 9, followed by removal of RSA/SHA-1 signatures and diffie-hellman-group-exchange-sha256 on January 13, 2027.
Who it affects. Teams using Git over SSH on GitHub Cloud. HTTPS Git remotes are unaffected. Existing RSA keys can continue with clients that support RSA/SHA-2. The announcement places these restrictions in Enterprise Server 3.25 rather than applying the Cloud dates to every server.
What remains uncertain. The announced dates do not establish which algorithms your clients negotiate or how they behaved during the earlier window. An existing RSA key alone does not establish incompatibility.
One next step. Have the repository or build-system owner test the algorithms negotiated by build agents, deployment jobs and older Git libraries before December 9. Confirm new-key provisioning meets the current upload minimum. GitHub recommends Ed25519 where supported; an existing RSA key does not need replacement solely because it is RSA.
Related
Where to go next
Automation access: npm tokens, workflow policies, and an IoT TLS fix