Checking permitted scopes with user-supplied fine-grained personal access token

[KieranP]

Select Topic Area

Question

Body

I am the author of https://github.com/KieranP/Github-Releases-Feed , a Github Release Feed solution to Github's broken release feed homepage. People who use the free opensource service need to provide a fine-grained personal access token.

I want to provide additional functions on the site based on what scopes the user permits. For example, some might only want to see releases for starred repos. Others might want to add the ability to unstar repos or react to releases.

In order to provide selective UI features they can actually interact with, I need to know what scopes the selected for their access token. e.g. I don't want to show an "Unstar" button if they didn't give that scope.

But from what I can find, there is currently no way to query what scopes a Fine-grained PAT has been permitted.

Is there something I am missing? Is there a way to achieve this? And if not, is it likely to get added at some point?

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[rubrx]

Hey @KieranP,

Great question — and you're not missing anything obvious. Unfortunately, you're right: GitHub currently doesn’t provide a way to query the scopes or repository permissions of a fine-grained personal access token (FGPAT). Unlike classic PATs (which expose scopes in the X-OAuth-Scopes header), fine-grained tokens just don’t offer a way to introspect their permissions.

So what can you do?
Since there's no built-in way to check what a token can do, here are a few workarounds people use in situations like yours:

1. Permission Probing via API
   You can “test” a feature by trying the associated API call and checking the response. For example, before showing an "Unstar" button, you could try a GET /user/starred/:owner/:repo or a dry-run PUT, and if it fails (403 or 404), hide or disable that feature in the UI.

It’s not ideal, but it works and ensures the user only sees what their token actually allows.

2. Let Users Self-Declare Features
   Let users check boxes or enable features manually based on what they expect their token to do. You can then verify in the background and prompt them if something’s not working due to permission issues.

3. OAuth App (Optional)
   If you're open to a more complex setup, GitHub’s OAuth apps do return the exact scopes a user has granted. It's a bigger lift than PATs but gives you the control you're looking for.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[KieranP]

Bumping this in the hopes that it will get a response from Github Staff with a possible timeline. Without this function, it makes creating applications that adapt to an PATs permitted scopes impossible without resorting to permission probing, which introduces a range of complications.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬