Why is a GitHub App preferred over a PAT for machine authentication?

Question

Options

• AGitHub Apps are required to pass SAML assertions
• BGitHub Apps have time-limited installation tokens with scoped access
• CPATs cannot be used in GitHub Actions
• DPATs support fewer GitHub APIs than Apps

• A
  8% (3)
• B
  87% (34)
• C
  3% (1)
• D
  3% (1)

Explanation

GitHub Apps generate short-lived installation tokens (typically 1 hour) that are scoped to specific repositories and permissions, making them far safer than Personal Access Tokens for machine authentication. If a token is compromised, the blast radius is limited by both time and scope - it expires soon and only grants access to what was explicitly configured.

Why the distractors are wrong:

• A - SAML assertions are an SSO/identity federation mechanism unrelated to how GitHub Apps authenticate; neither Apps nor PATs "pass SAML assertions" as part of their auth flow.
• C - PATs can be used in GitHub Actions (via secrets.GITHUB_TOKEN alternatives or stored secrets); they're just less secure than using the built-in GITHUB_TOKEN or a GitHub App.
• D - PATs actually support a broad range of GitHub APIs; the limitation is around organizational and fine-grained control, not API surface coverage.

Memory tip: Think of a PAT as a master key that never expires (by default) and opens many doors - dangerous if lost. A GitHub App token is a time-stamped keycard that only opens the rooms you specified and self-destructs in an hour. Exam questions about machine authentication best practices almost always point to the principle of least privilege + expiry - which is exactly what option B describes.

No community discussion yet for this question.