What you are actually deleting
A personal access token (PAT) is one credential among several that can act on your GitHub account. Before deleting anything, it helps to know which kind of credential you are looking at, because the removal steps and the side effects differ.
| Credential | What it typically does | Where it is managed | What deleting it affects |
|---|---|---|---|
| Personal access token (fine-grained or classic) | Lets scripts, tools or CI act on your behalf with scoped permissions | Settings → Developer settings → Personal access tokens | Anything still using that token, plus any deploy key the token created |
| OAuth authorization | A third-party app you approved to act on your account | Settings → Applications (authorized OAuth apps) | That app’s access; the app itself is not deleted |
| SSH account key | Authenticates Git operations over SSH for your account | Settings → SSH and GPG keys | SSH access that relies on that key |
| Browser session | An active signed-in session in a browser | Sign-out controls and session settings | That session only; it is not a token or key |
This article covers the first row. The other rows are listed so you do not mistake one for another: removing an OAuth authorization or an SSH key does not delete a personal access token, and deleting a token does not revoke SSH keys or end browser sessions.
Step 1: Build a token inventory without exposing values
The goal is a list of token names and where each one is used — not a list of token strings. Treat the token value as a secret you never copy into notes, tickets or chat.
- Open your GitHub account settings and go to Developer settings, then Personal access tokens. Check both Fine-grained tokens and Tokens classic, since the two types are listed separately.
- For each token, record only: the token name, its type (fine-grained or classic), and any note GitHub shows about its purpose or expiry.
- For each token, write down where you believe it is used: a CI job, a deployment script, a local tool, a scheduled task, a third-party integration, or nowhere you can recall.
- Mark tokens you cannot place. An unplaced token is a candidate for review, not automatic deletion — something may still depend on it.
A simple working table is enough:
| Token name | Type | Known consumer | Last known use | Decision |
|---|---|---|---|---|
| example-deploy | Fine-grained | CI deploy job | Unknown | Check job before deleting |
| example-old-script | Classic | None found | Old | Verify, then delete |
Do not paste token values into this table. If a consumer stores the token, check that system’s own configuration rather than re-reading the secret.
Step 2: Check dependent automation before removal
Deleting a token breaks whatever still authenticates with it. Before you delete, confirm each known consumer:
- Search your CI configuration, deployment scripts and scheduled jobs for references to the token name or the secret store entry that holds it.
- Check whether the token’s permissions match what the consumer needs. A token that looks unused may be the only working credential for a small job.
- Decide per token: keep, replace with a narrower credential, or delete. If you cannot confirm a consumer, pause rather than guess.
GitHub documents one specific dependency worth checking first: a personal access token that created a deploy key is linked to that deploy key.
GitHub warns that deleting a personal access token that created a deploy key also deletes that deploy key. Source
That warning is narrow. It applies to deploy keys created by that token. It is not a statement that deleting any token affects every SSH key, every deploy key or every integration on the account. Check the specific token’s history and the repository’s deploy keys rather than assuming a broad effect.
Step 3: Delete the token
When you have confirmed a token is safe to remove, GitHub’s documented path is:
GitHub’s personal access token deletion path is Settings, Developer settings, Personal access tokens, then Fine-grained tokens or Tokens classic and Delete. Source
After deletion, verify the result rather than assuming it worked:
- Confirm the token no longer appears in the list for its type.
- Run or trigger the automation you identified as a consumer and check whether it still authenticates. If it fails, you have found a dependency you missed; restore access with a new credential you control rather than reusing the old value.
- If the deleted token had created a deploy key, check the repository’s deploy keys to confirm the documented removal occurred and that no other key was affected.
Failure paths to plan for
| Situation | What to do |
|---|---|
| A CI job fails after deletion | Identify which secret it used, confirm the job’s owner, and issue a replacement credential through your normal process |
| You cannot find a token’s consumer | Do not delete on a guess; search configuration files and secret stores first, and keep the token until you can confirm |
| A deploy key disappeared | This is the documented consequence when the token created it; recreate the key deliberately if the repository still needs it |
| You are unsure whether the credential is a token or an OAuth app | Check the settings section it appears under; the two are managed separately |
What this checklist does not cover
This guide does not describe rotating credentials, issuing new tokens, or changing permissions — those steps depend on your own setup and GitHub’s current interface, which you should confirm at the time you act. It also does not cover removing OAuth authorizations, SSH account keys or browser sessions beyond noting that they are separate. Deleting a token removes that credential; it does not by itself prove that any data held by a connected service has been erased.
Where a username lookup fits, and where it does not
If your cleanup is part of a broader review of what is publicly visible under a username, TraceSeek is a separate app that checks known public usernames across 3,000+ platforms. It reports public matches, which are leads rather than proof of ownership, and it cannot sign in to accounts, change account settings, delete tokens or verify anyone’s real identity. It is not a tool for private-account access or guaranteed removal of anything. For the token task in this article, the work happens in your GitHub settings, not in a lookup app.