GitHub has completed the staged rollout of the stateless GitHub App installation token format. The rollout began on April 27, 2026, and is now complete, per the GitHub Changelog notice published on October 2, 2026.
WHAT CHANGED FOR NEW INSTALLATION TOKENS
By default, newly minted GitHub App installation tokens use the stateless ghs_APPID_JWT format. This design aims to make token issuance and validation faster and improve the reliability of the GitHub API. TechStaged has also covered GitHub expands SecurityAdvisory GraphQL API with five new fields and two filters.
Installation tokens still begin with the ghs_ prefix, but the token string length has increased to about 520 characters from the former ~40 characters.
WHAT STAYED THE SAME
Token permissions, repository scoping, the one-hour expiration, and the installation access token REST API endpoint remain unchanged from prior behavior.
LEGACY TOKENS REMAIN VALID UNTIL EXPIRY
Tokens minted before the change continue to work until their expiration, providing a backward-compatible path for existing workflows.
DEPRECATION OF THE TEMPORARY VALIDATION HEADER
The temporary X-GitHub-Stateless-S2S-Token request header, which allowed on-demand validation of the new format, will be deprecated on November 30, 2026. After that date, GitHub will no longer honor the header, and all eligible apps will default to stateless tokens.
Developers should remove the header from production code before November 30, 2026, once both token formats have been validated in their environments.
MIGRATION GUIDANCE FOR DEVELOPERS
After validating apps and workflows with both token formats, remove the temporary header from production code before November 30, 2026.
GUIDANCE FOR ADOPTING THE NEW TOKEN FORMAT
Treat tokens as opaque strings in all systems. Ensure databases, secret stores, and environment variables do not assume a fixed or small maximum length. Review proxies or middleware to ensure long Authorization headers are not truncated, and update logging or redaction rules to accommodate the longer token format.
RELATED COVERAGE
- GitHub expands SecurityAdvisory GraphQL API with five new fields and two filters
- GitHub posits AI is reshaping developer work, urges three skills to sharpen
- GitHub opens REST API for repository security advisory comments in public preview
- Cloudflare opens closed beta for OHTTP Gateway to broaden privacy-preserving infrastructure
- Developer Tools articles
SOURCES
- Archive: 2026 - GitHub Changelog: Stateless GitHub App installation tokens rolled out Published · Primary source
