How to get PAT (personal access token) details without the website?

[CodeSandwich]

Select Topic Area

Question

Body

I have a PAT and I need to check its details, like its name and permissions. How can I do it using REST or GraphQL API and without using the GitHub website? I've found out that I can check the expiry date in the HTTP response header if I use the PAT for any request for which it's sufficient and that's useful, but not enough.

[yoter-k]

You can inspect a PAT without using the GitHub web interface by calling the GitHub REST API endpoint that returns information about the token you’re using:

Using REST API

curl -H "Authorization: token YOUR_PAT" \
     https://api.github.com/user

• Returns the user the token belongs to.
• You can also try any request that requires specific scopes — the response will include headers indicating the token’s scopes:

curl -I -H "Authorization: token YOUR_PAT" https://api.github.com/user

Look for the header:

X-OAuth-Scopes: repo, workflow, read:org

This tells you what permissions the token has.

Using GraphQL

curl -H "Authorization: bearer YOUR_PAT" \
     -X POST -d '{"query":"{ viewer { login } }"}' \
     https://api.github.com/graphql

• Returns the authenticated user (viewer).
• You can use GraphQL queries to access additional user info, but scope information is only visible via REST headers.

✅ TL;DR

• Use curl with REST /user endpoint to see the authenticated user and the token’s scopes from X-OAuth-Scopes.
• GraphQL only confirms authentication, not detailed scopes.

[CodeSandwich]

Thanks, I missed the x-oauth-scopes header! Is there any way to get the token name?

[yoter-k]

GitHub does not expose the PAT’s name via any API for security reasons.

The only ways to see it are:

1. Via the GitHub web interface: Settings → Developer settings → Personal access tokens.
2. Keep a record yourself when creating the token (e.g., in a secure vault or environment variable).

✅ TL;DR

• API can show scopes and authenticated user, but token name is never available via API.

[CodeSandwich]

It's unsupported, that's fair, thank you for that clarification 👍 Let's be real though, there are no security reasons, that's a boilerplate excuse to make GitHub lacking a feature look good. There's no additional harm the holder of PAT can do if they learn the name of the token and e.g. GitLab freely exposes both the name and the description in their API.

[yoter-k]

You’re right that knowing the token name itself doesn’t create a security risk — it’s more of a GitHub design limitation. Unlike GitLab, GitHub currently does not expose token names or descriptions via API, so for now the only way is via the web interface or keeping your own record.