Yes. GitHub App private keys do not expire automatically. Anyone who obtains a usable key can authenticate as that app, and the potential impact depends on the app’s permissions and the accounts where it is installed. The key does not, by itself, take over a GitHub user account or grant access to every repository on GitHub.
Do GitHub App private keys expire?
No. GitHub says an app’s private keys remain valid until an authorized app owner deletes them. A forgotten copy may therefore remain useful even after the team has stopped using or remembering it. See GitHub’s private-key management guidance.
As an Amazon Associate I earn from qualifying purchases.
The key signs a JSON Web Token (JWT) that authenticates the app when it requests an installation access token. The private key and that token are separate credentials with different lifetimes: GitHub’s REST API documentation says an installation access token expires one hour after creation by default, but that does not cause the key that signed the JWT to expire. See GitHub’s installation-token documentation.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What can someone do with a leaked key?
A person holding the key can authenticate as the GitHub App and seek installation access tokens. What those tokens can reach depends on the app’s permissions and its installations. GitHub notes that an app’s key can grant access to each account where the app is installed; it does not mean the holder automatically gains unrestricted access to all GitHub repositories or to a user’s personal account.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
That distinction determines the likely blast radius. An app installed in many organizations or granted broad permissions creates greater potential exposure than one with narrow permissions and limited installations. Grant only the permissions the app needs, and limit installation and token access where possible. GitHub’s guidance on GitHub App security practices recommends minimizing permissions.
Why does a forgotten key remain a risk?
Deleting an app from a service, stopping a workflow, or forgetting where a PEM file was saved does not revoke the key at GitHub. If a copy remains accessible in a repository, build environment, secret store, or old deployment, it may still be used while the key remains registered. The relevant control is revoking the key with GitHub, not merely removing one copy.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How should you store a GitHub App private key?
Choose storage based on which systems need to use the key and whether they need to read its private value. GitHub suggests considering a key vault, such as Azure Key Vault, and a sign-only design where infrastructure can request signatures without being able to retrieve the private key. A vault reduces exposure of the key material, but access to the signing service and the workloads allowed to invoke it still need protection.
Free tools Windows power users keep installed
One-click scans. No signup required.
Keeping a key in an environment variable is weaker when an attacker can access that environment: they may be able to read the value and authenticate as the app. Hard-coding a key into source creates a similar exposure if that source becomes accessible. For any approach, review which identities and workloads can use the key, whether that use is auditable, and how quickly a replacement can be deployed. GitHub’s key-management documentation covers storage and key rotation.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How do you rotate a GitHub App private key?
- Create a replacement key for the GitHub App and provision it to the service that needs to sign app JWTs.
- Update the service to use the new key. Keep the old key in place during the transition if the app needs uninterrupted service.
- Verify the replacement works by confirming the service can authenticate and perform its expected app functions with the new key.
- Delete the old key from the app’s key settings once the service is working with the replacement.
GitHub supports multiple private keys so teams can rotate without downtime. Do not delete the only working key before its replacement is provisioned and verified.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should you do if a key may have leaked?
- Revoke the exposed key at GitHub. Treat it as compromised even if it appeared in a private repository or was removed quickly.
- Replace it where needed. Generate a new key, update the affected service, and verify it works before relying on it.
- Investigate where the key went. Review repositories and their history, build logs, deployment environments, and secret stores that may have held a copy.
- Review available access records for signs that the app was used unexpectedly, and assess which installations and permissions were exposed during the period the key was valid.
Removing the text from a repository is not enough: GitHub’s leaked-secret guidance warns that deleting the value from source—or deleting and recreating the repository—does not prevent exploitation. Revoke the credential with the provider. See GitHub’s leaked-secret and secret-scanning guidance.
Quick Recap
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
