Time to Bail · Boarding pass
Check. You can stay.
GitHub ignores the header from November 30, 2026. Apps that use it to get old tokens get new ones.[1]
Act means: change a setting or plan before the date. You can stay.
GitHub App token format header stops working November 30, 2026
GitHub App tokens now have a new, longer format. They are about 520 characters, not 40. A test header, X-GitHub-Stateless-S2S-Token, let apps ask for the old kind. From November 30, 2026, GitHub ignores it. Then apps get only the new tokens.
One email with the first steps. Nothing else.
Or add the date to your calendar: Apple or Outlook (.ics) · Google Calendar
Tick steps as you go. Your progress stays in this browser.
Search your code for X-GitHub-Stateless-S2S-Token.
Check database columns, secret stores, proxies and log filters. Tokens are about 520 characters now.
Delete it once your app works with the new tokens.
One email with the first steps. Nothing else.
Or add the date to your calendar: Apple or Outlook (.ics) · Google Calendar
| Header no longer respected | November 30, 2026[1] |
|---|---|
| New installation token | Starts with ghs_, about 520 characters long instead of 40[1] |
| Header | X-GitHub-Stateless-S2S-Token on POST /app/installations/:installation_id/access_tokens[2] |
| What the disabled value did | Returned a classic opaque token, even after the rollout reached the app[2] |
| Pattern GitHub suggests for both formats | ghs_[A-Za-z0-9\.\-_]{36,}[2] |
| Storage | Database columns and header settings must accept at least 520 characters[2] |
| Tokens made before | Keep working until they expire[1] |
| GitHub Enterprise Server | Not affected[2] |
| Announced | October 2, 2026[1] |
| Apps that send the header | Get stateless tokens after November 30, 2026[1] |
Check it yourself. Every fact above links here.
Time to bail on GitHub Apps that send the stateless token header? Check. You can stay. GitHub ignores the header from November 30, 2026. Apps that use it to get old tokens get new ones.
On our scale this is Act: change a setting or plan before the date. You can stay.
GitHub App tokens now have a new, longer format. They are about 520 characters, not 40. A test header, X-GitHub-Stateless-S2S-Token, let apps ask for the old kind. From November 30, 2026, GitHub ignores it. Then apps get only the new tokens.
Here are the facts we checked:
You can stay on GitHub. You have to change a setting or plan before the date.
Leaving is a choice here, not a must.
GitHub is the main source for this page. GitHub has not said more than what is listed here. If a fact is not on this page, we do not know it yet.
Apps that send the header: Get stateless tokens after November 30, 2026.
The date to remember is November 30, 2026. Make the change before then.
A few tips:
If the change affects your members or team, send one short email. Say what changes for them and when. Put the most important line first.
If there is a date, send a short reminder a few days before it. Keep a copy of the list you sent it to.
Listed for convenience. Not ranked. Not paid. These names come up in threads and reviews; that does not show where people moved.
Before you pay, check the price page of each tool yourself. Prices change, and we only list what our sources say.
No questions collected yet.
Thanks.
Run SaaS spend at work? Get these changes before the invoice
Arrivals · for builders
People on GitHub Apps that send the stateless token header can stay if they make the change. Some would rather leave. Get the playbook for this change, and list your product here.
Listing is free. An editor checks it. Not ranked. Not paid.
One email when we publish a checked change in the category you pick. No account needed.
One email on Mondays: the gates in the next 14 days, with the first step for each.