GitHub Enterprise adds one CSV export listing every credential that can reach the enterprise, from SSH keys to OAuth App tokens

GitHub published a Changelog entry on 21 September 2026 saying enterprise owners can now export a full inventory of every credential that can reach the enterprise, in a single CSV or through a new REST endpoint. The list covers SSH keys, classic and fine-grained personal access tokens, OAuth App access tokens, and GitHub App user-to-server and installation tokens.

What the export contains

Each row carries the credential's owner, its scopes and permissions, its creation and expiration dates, the date it was last used, and the target organizations or repositories it can reach. GitHub says the CSV can be filtered by user, app, credential type or organization before it is generated, so an owner narrowing down to one team or one credential type gets that slice on its own.

The same data is available through paginated REST endpoints listed under enterprise-admin/token-inventory, which GitHub says teams can wire into their own reporting or automation. The company points to its documentation on responding to security incidents as the intended read alongside the export.

Who can run it, and where it lives

An enterprise owner, or a member holding the fine-grained View enterprise credentials permission, can generate the export. In the interface, the button is called "Export CSV" and sits under enterprise Settings, then Authentication Security, then Credentials, next to the overview section. Programmatic access is through the REST endpoints named above.

GitHub says the release is available now for GitHub Enterprise Cloud, and that GitHub Enterprise Server will pick it up in an upcoming release without naming a date.

The gap this closes for incident response

Naming every credential that could be affected by a leak used to depend on the credential type. SSH keys, personal access tokens and app tokens each sat behind a separate query, and a token type a responder forgot to check stayed live under a compromised account until somebody remembered it. A single CSV that lists them together, with last-used dates and target organizations already on the row, answers the first question a response team asks: which credentials could reach the affected system, and when did each one last do so.

The value is limited to teams on Enterprise Cloud today, which is a paid tier, and to enterprises whose owners hold the permission the export requires. The export lists what exists and where it can reach; whether any given credential was actually used during a compromise is a separate query against the audit log, which GitHub points to in the linked documentation.

Source

GitHub Changelog, GitHub Enterprise adds credential inventory exports, 21 September 2026.