Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesTo use a classic personal access token (PAT) or an SSH key with an organization that enforces SAML single sign-on on GitHub Enterprise Cloud, you authorize that credential for the organization yourself, in your GitHub account settings, after you have signed in to the organization through its identity provider (IdP). A classic PAT is authorized from Developer settings. An SSH key is authorized from SSH and GPG keys. Authorization is set per organization, so a credential approved for one organization is not automatically approved for another.
If you cannot find the Configure SSO button, the usual cause is that your account has no linked external identity yet. The fix is covered below, along with the error responses an unauthorized token returns and the limits on automating the step. The guidance reflects GitHub Enterprise Cloud documentation as checked on October 7, 2026.
As an Amazon Associate I earn from qualifying purchases.
Before you start
Three conditions have to be true before any authorization step works:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- You are on GitHub Enterprise Cloud. GitHub’s credential reference says SSO credential authorization does not apply to GitHub Enterprise Server. See GitHub credential types.
- You have a linked external identity for the organization. GitHub says you establish this link by authenticating to the organization with its identity provider at least once.
- You know which credential type you are using. A classic PAT and an SSH key are authorized on different settings pages, and a fine-grained PAT is handled in a different way, described in the comparison table below.
Once a linked identity exists, GitHub requires authorized PATs and SSH keys for that organization even when SSO is not enforced on the organization. Linking the identity therefore changes how your existing credentials behave, not only new ones.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
GitHub’s own wording for the two credential types is direct:
- “To use a personal access token (classic) with an organization that uses single sign-on (SSO), you must first authorize the token.” (GitHub Docs: Authorizing a personal access token for use with single sign-on)
- “To use an SSH key with an organization that uses single sign-on (SSO), you must first authorize the key.” (GitHub Docs: Authorizing an SSH key for use with single sign-on)
Why you don’t see Configure SSO
The button is missing for one of three reasons, and each has a different fix:
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- No linked identity. Sign in to the organization through its IdP once. Then return to the settings page and check again.
- Enterprise IP allow list. If the organization belongs to an enterprise that has both enterprise-level SSO and an IP allow list enabled, your current IP address must also be allowed at the enterprise level. An IP that is not on the list blocks authorization even when your identity is linked.
- Wrong credential or page. Classic PATs are under Developer settings, and SSH keys are under SSH and GPG keys. The button only appears beside a credential that can be authorized.
Authorize a classic personal access token
A classic PAT is authorized after it has been created. Complete the prerequisites above first, then follow these steps:
- Click your profile photo in the upper-right corner of GitHub and select Settings.
- In the left sidebar, select Developer settings, then Personal access tokens.
- Beside the token you want to use, select Configure SSO.
- In the organization list, select Authorize beside the organization that needs access.
Repeat step 4 for each organization that the token must reach. Each authorization is independent. Authorizing a token for one organization does not grant it access to any other.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Authorize an SSH key
You can authorize a key that already exists on your account, or generate a new key and authorize that. Use this path:
- Click your profile photo in the upper-right corner of GitHub and select Settings.
- In the Access section of the left sidebar, select SSH and GPG keys.
- Beside the key, select Configure SSO.
- In the organization list, select Authorize beside the organization that needs access.
Two details matter here. SSH certificates signed by the organization’s SSH certificate authority do not need this authorization step, so if your organization issues certificates, the procedure above does not apply to them. Also, if an organization later revokes authorization for a key, that same key cannot be reauthorized, which is covered under recovery below.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How the credential paths differ
| Credential | Where authorization happens | When it happens | If authorization is revoked |
|---|---|---|---|
| Classic personal access token | Settings, Developer settings, Personal access tokens, Configure SSO | After the token is created | Not stated for re-authorizing the same token in the cited procedure; the token’s authorization ends when the owner revokes it, you leave the organization, or the token is changed or expires |
| Fine-grained personal access token | During the token creation flow | At creation | Not stated in the cited procedure |
| SSH key | Settings, SSH and GPG keys, Configure SSO | After the key exists, whether it was already on your account or newly generated | The same key cannot be reauthorized; create and authorize a new key |
Sources for these rows are the GitHub documentation pages for classic PATs and SSH keys.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Errors from an unauthorized classic PAT
A classic PAT used against a single organization that enforces SAML SSO, without prior authorization, can return either a 404 Not Found or a 403 Forbidden. The status code alone does not tell you whether the problem is authorization, so check the response headers.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- On a 403, look for the
X-GitHub-SSOresponse header. It can contain a URL that authorizes the token for the organization. GitHub says this URL expires after one hour, so generate a new request if it has lapsed. - On a request that spans several organizations, the
X-GitHub-SSOheader can list the organizations that still require authorization. The API may also return partial results instead of an error, so do not assume a successful response covers every organization you queried.
GitHub’s REST authentication documentation covers these responses in more detail at Authenticating to the REST API.
Revocation and recovery
An authorization stays in place until one of three things happens: an organization or enterprise owner revokes it, you are removed from the organization, or the token is changed or expires. Revoking authorization is not the same as deleting the credential. For a credential you no longer trust, you can revoke its SSO authorization so it is blocked from that organization’s resources while the credential still exists on your account. If you want it gone entirely, delete it.
For SSH keys, the recovery path is stricter. Once an organization revokes a key’s authorization, that key cannot be reauthorized. Generate a new key, add it to your account, and authorize the new key using the steps above.
What can and cannot be automated
The documented procedure for individual users is the account settings page described above. The cited GitHub documentation describes authorizing a credential for an organization through that interface, and separately describes a multi-organization GitHub App method intended for enterprise administrators. The documentation covered here does not establish that an individual user can script or use the CLI to complete the authorization step on their own behalf.
In practice, plan for the browser step. A script can detect the 403 and read the X-GitHub-SSO header, which is useful for alerting or for guiding a user to the right URL. A script should not be presented as a way to skip the authorization itself, because the organization’s access control still requires it.
Quick Recap
“
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
