ST-2026-131 · Authentication & identity
GitHub begins staged rollout of stateless GitHub App installation tokens
GitHub began a staged rollout of longer, variable-length stateless installation tokens using a ghs_APPID_JWT format of roughly 520 characters, requiring clients to treat tokens as opaque.
Previous state
Installation-token consumers commonly handled the classic token format and could embed fixed-length, regular-expression or storage assumptions.
Current state
Newly minted tokens can use the longer variable-length stateless format; existing tokens continue until expiry and a temporary per-request header can force the new or classic format during testing.
Affected users
Who needs to care
GitHub Apps and integrations that issue, store, validate, transmit or log installation access tokens on GitHub Enterprise Cloud or Data Residency.
Required response
What to do
Remove fixed-length and format validation, enlarge storage and transport fields, redact tokens robustly, and test both formats using the documented override.
Evidence boundary
What the source does not prove
The rollout does not apply to GitHub Enterprise Server. GitHub does not support client-side validation of the JWT-like token and the record does not claim rollout completion.
Lifecycle history
Dated event sequence
- New token format announced
GitHub described the stateless, variable-length installation token.
- Staged rollout began
GitHub started issuing the new format in stages.
- Per-request override documented
GitHub added a temporary header to force new or classic format for compatibility testing.
Evidence ledger
First-party sources
- 01GitHub Changelog — Notice about upcoming new format for GitHub App installation tokens
Official authentication-contract announcement · 2026-04-24
Open official source ↗ - 02GitHub Changelog — GitHub App installation tokens per-request override header
Official compatibility announcement · 2026-05-15
Open official source ↗