Authentication

Learn token-based authentication.

GitHub API authentication

The GitHub API allows access to some public resources without authentication. Authentication is required to access private resources or benefit from higher request limits.

Authorization: Bearer YOUR_TOKEN

A token is used to authenticate your identity in an API request. You should never add token values to public repositories or source code.

Using a Personal Access Token

A Personal Access Token (PAT) allows you to perform API operations on behalf of your GitHub account with specific permissions. Granting only the required permissions when creating a token is important for security.

curl -H "Authorization: Bearer $GITHUB_TOKEN" \
  https://api.github.com/user

Keeping the token in an environment variable is safer than writing it directly into a script. If a token is exposed, revoke its access and create a new one.

Exercise Request user information with a token

Use the GITHUB_TOKEN environment variable to send a request to the GitHub user endpoint. Use Bearer token authentication and the GET method. Print the HTTP response status code.

Show example solution

curl -sS -o /dev/null -w "%{http_code}
" -X GET -H "Authorization: Bearer $GITHUB_TOKEN" https://api.github.com/user

Test yourself

Which HTTP header is used to securely send a personal access token in an API request?
- Accept-Language
- User-Agent
- Content-Type
- Authorization
Show answer

Authorization — The <code>Authorization</code> header carries token-based authentication credentials.

Define the PAT variable

export GITHUB_TOKEN=ghp_example_token____

Show answer

export GITHUB_TOKEN=ghp_example_tokenGITHUB_TOKEN

Token security concepts

PAT

Personal access token
Bearer

Token transmission scheme
Scope

Token permission scope
Environment variable

Stores a secret value in the environment

Next lesson: Organizations

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies