GitHub hands enterprises a full credential inventory
A new export and REST endpoint list every key, token and app credential that can reach an enterprise, with owners, scopes and last-used dates attached.
GitHub Enterprise owners can now pull a complete list of the credentials that can reach their organisation. The changelog entry for 21 September describes an export that covers SSH keys, classic and fine-grained personal access tokens, OAuth app access tokens, and the user-to-server and installation tokens belonging to GitHub Apps, in one place rather than four settings pages.
What the inventory shows
The export is available as a CSV from enterprise settings, and the same data can be pulled programmatically through a paginated REST API for teams that want to build their own reporting. Results can be filtered by user, app, credential type or organisation, and each row carries the owners, the scopes and permissions attached to the credential, when it was created, when it expires, when it was last used, and which organisations or repositories it can touch.
Built for the worst week of the year
GitHub's framing is incident response. When a token leaks, the first useful question is how much of the estate that token could reach, and the second is who else holds something like it. The inventory is meant to answer both from a single view, and it correlates with audit log activity so an investigating team can see which credentials were actually used rather than which ones merely existed.
Permissions and availability
Access to the inventory is controlled by a fine-grained permission called View enterprise credentials, so it can be granted to the security staff who need it without making every enterprise owner a credential auditor. Enterprise owners will find the Export CSV control in Settings, under Authentication Security and then Credentials, next to the Overview section. GitHub says the feature is available now on GitHub Enterprise Cloud and will be supported in upcoming releases of GitHub Enterprise Server.
Our opinion
Credential sprawl is the quiet failure mode of every large engineering organisation: nobody knows how many tokens exist until one of them turns up in a paste site. What makes this release more than housekeeping is the last-used column, because a credential with a scope list and no usage history is exactly the one worth deleting, and that argument is much easier to win with a filter than with a rule. The honest caveat is coverage: enterprises live in more than one identity provider, and a GitHub-only inventory still leaves the tokens in CI secrets and cloud accounts unaccounted for. Treat it as the first pane, not the whole window.