GitHub app tokens grew about 13 times longer. Your code may still expect the old size.
By Lior AharonovFounder, 7IT Solutions ·
On 2 October 2026 GitHub finished moving GitHub App installation tokens to a stateless format, a rollout that started on 27 April. Same ghs_ prefix. But about 520 characters now, instead of 40.
This kind of break makes no noise. A 40-character database column, a length check, a log filter or a proxy that trims long headers just cuts the token short, and the failure looks like a login problem, not a length problem.
Search your code and schemas today for a 40-character limit on tokens, and treat the token as an opaque string. Still sending the X-GitHub-Stateless-S2S-Token header from testing? Remove it before 30 November 2026, when GitHub deprecates it.
The bugs I fear most don't crash anything. They quietly cut a string short and let you chase the wrong problem for a day.
Lior Aharonov · my takeSources
Researched with AI tools; every fact is checked against the linked sources.