GitHub App installation tokens are no longer 40 characters
- Announced
- 24 Apr 2026
- Effective
- no date announced
- Source
- the vendor’s own page · last checked 15 Sept 2026
What breaks
Anything that assumed the old length stops working: a varchar(40) column that truncates the token without error, a regex like ghs_[A-Za-z0-9]{36} that no longer matches, a secret scrubber that stops redacting it from logs. The failure is authentication refused with a token that looks perfectly normal, which is why it is usually diagnosed late.
What to do
Treat the token as an opaque string of unbounded length. Check the places that constrain it: the database column that stores it, any regex that validates or redacts it, log scrubbing patterns, and fixed-size buffers. GitHub's recommended pattern for both formats is ghs_[A-Za-z0-9.\-_]{36,}. The per-request override header lets you exercise the new format deliberately before trusting it.
What the vendor said
On 24 April 2026 GitHub announced a stateless format for installation tokens: still prefixed ghs_, but a signed JWT of roughly 520 characters containing two dots, instead of a fixed 40-character opaque string. The staged rollout ran from 27 April to late June 2026 — GitHub Actions and first-party integrations first, then every GitHub App. GitHub named a window, not a cut-off day.