---
title: "GitHub App installation tokens are now about 520 characters long: 2026-10-02 | Harbyn"
description: "GitHub App installation tokens are now about 520 characters long, announced Oct 2, 2026."
canonical: "https://harbyn.com/changes/github/2026-10-02-github-app-installation-tokens-now-about-520-characters"
last-updated: 2026-10-02
---

# GitHub App installation tokens are now about 520 characters long

Markdown version of <https://harbyn.com/changes/github/2026-10-02-github-app-installation-tokens-now-about-520-characters>.

Breaking change - GitHub. high severity. In effect.

All newly minted GitHub App installation tokens use the stateless ghs\_APPID\_JWT format: still prefixed ghs\_, but about 520 characters instead of 40. Permissions, scoping, the one-hour expiry and the token endpoint are unchanged. Code that validates a 40-character length, stores tokens in short columns, or truncates long Authorization headers breaks; tokens minted earlier work until they expire.

## Facts

| Fact | Value |
| --- | --- |
| Vendor | [GitHub](https://harbyn.com/vendors/github.md) |
| Kind | Breaking change |
| Severity | high |
| Status | In effect |
| Announced | Oct 2, 2026 |
| Added to Harbyn | Oct 2, 2026 |
| Lead time | No dated deadline |
| Vendor page | <https://github.blog/changelog/2026-10-02-stateless-github-app-installation-tokens-rolled-out> |
| Review | Reviewed by a person, extracted by a person |

## Find it in your code

```sh
npx harbyn scan
```

This change names no identifier the scanner can match line by line, so the scan tells you whether your repository uses GitHub, from its packages and API hosts. Nothing leaves your machine.

## Sources

Where this event comes from: the page we read, when we read it, and the hash of that snapshot.

- <https://github.blog/changelog/feed/> (changelog, fetched 2026-10-02 23:20 UTC, sha256 `0ba86043060773911ff706b42e35bb0957aaa79dfe9d3d97ce54c12594fe5c4b`)

## Related changes

### More from GitHub

- [Copilot code review now defaults to the Balanced effort level](https://harbyn.com/changes/github/2026-10-02-copilot-code-review-api-support-and-new-default-effort-level-2.md) (Behavior change, announced Oct 2, 2026)
- [Gemini 3.5 Flash deprecated in GitHub Copilot](https://harbyn.com/changes/github/2026-10-02-selected-models-in-github-copilot-deprecated.md) (Deprecation, effective Oct 2, 2026)
- [Gemini 3.6 Flash deprecated in GitHub Copilot](https://harbyn.com/changes/github/2026-10-02-selected-models-in-github-copilot-deprecated-2.md) (Deprecation, effective Oct 2, 2026)
- [Kimi K2.7 Code deprecated in GitHub Copilot](https://harbyn.com/changes/github/2026-10-02-selected-models-in-github-copilot-deprecated-3.md) (Deprecation, effective Oct 2, 2026)

### Changes at other vendors

- [Amazon Selling Partner API: October listing attribute usage and enumeration value updates](https://harbyn.com/changes/amazon-sp-api/2026-10-14-sp-api-updates-new-listings-items-api-ivp-values-in-eu5-jp-and-ca-stores-oct-2.md) (effective Oct 26, 2026)
- [Supabase: four CBC-mode TLS 1.2 cipher suites will be removed from project HTTP APIs](https://harbyn.com/changes/supabase/2026-10-12-an-outdated-subset-of-tls-1-2-ciphers-will-be-disabled-on-project-http-apis.md) (effective Nov 10, 2026)
- [Google Workspace APIs: OAuth clients must be marked as agentic to call Google Workspace MCP servers](https://harbyn.com/changes/google-workspace/2026-10-12-oauth-clients-must-be-marked-as-agentic-to-call-google-workspace-mcp-servers.md) (effective Nov 11, 2026)
- [Bitbucket Cloud API: Git Credential Manager upgrade required for OAuth 2.0 Git authentication](https://harbyn.com/changes/bitbucket/2026-10-13-git-credential-manager-upgrade-required-for-oauth-2-0-git-authentication.md) (effective Nov 30, 2026)

[All upcoming deadlines](https://harbyn.com/deadlines.md)