GitHub App installation tokens are no longer 40 characters
- Announced
- 24 Apr 2026
- Effective
- no date announced
- Source
- the vendor’s own page · last checked 15 Sept 2026
What breaks
Anything that assumed the old length stops working: a varchar(40) column that truncates the token without error, a regex like ghs_[A-Za-z0-9]{36} that no longer matches, a secret scrubber that stops redacting it from logs. The failure is authentication refused with a token that looks perfectly normal, which is why it is usually diagnosed late.
What to do
Treat the token as an opaque string of unbounded length. Check the places that constrain it: the database column that stores it, any regex that validates or redacts it, log scrubbing patterns, and fixed-size buffers. GitHub's recommended pattern for both formats is ghs_[A-Za-z0-9.\-_]{36,}. The per-request override header lets you exercise the new format deliberately before trusting it.
What the vendor said
On 24 April 2026 GitHub announced a stateless format for installation tokens: still prefixed ghs_, but a signed JWT of roughly 520 characters containing two dots, instead of a fixed 40-character opaque string. The staged rollout ran from 27 April to late June 2026 — GitHub Actions and first-party integrations first, then every GitHub App. GitHub named a window, not a cut-off day.
Suricate tells you this before it lands, by email, only when your own repository is affected.
Watch my repositoryOne repository, free. We read your manifests and your configuration files. Never your code.
Watching more than one repository?
The team plan is not open yet.
No account, and no repository read. We store the address and the date, and nothing else — see privacy.