> ## Documentation Index
> Fetch the complete documentation index at: https://site.aspect.build/llms.txt
> Use this file to discover all available pages before exploring further.

# Generate a GitHub App token

> Mint a short-lived token from the Aspect Workflows GitHub App for one repository, optionally narrowed to specific roles, and print it to stdout.

`aspect github token` mints a short-lived token from the [Aspect Workflows GitHub App](/docs/cli/authentication-github) for one repository and prints it to stdout. Use it when a script or CI step needs to call the GitHub API, and you'd rather not store a personal access token:

* **Post from a pipeline**: comment on a pull request, set a commit status or create a check run from a deploy or release step.
* **CI hosts without a GitHub token**: Buildkite and CircleCI don't hand the job one, so this is the job's GitHub credential.
* **Least privilege**: `--role` narrows the token to what the step needs, and it expires on its own.

```shell theme={null}
aspect github token my-org/my-repo
GH_TOKEN="$(aspect github token my-org/my-repo --role=prs.write)" gh pr comment 123 --body "Deployed"
```

It authenticates to Aspect Cloud with your stored login, or `ASPECT_API_TOKEN` on CI, so the GitHub App must be installed on the repository and linked to your Aspect account. See [Authenticating the Aspect CLI](/docs/cli/authentication).

## Options

| Flag                  | Default                                | What it does                                          |
| --------------------- | -------------------------------------- | ----------------------------------------------------- |
| positional repository | required                               | The repository, as `OWNER/REPO`                       |
| `--role <role>`       | none                                   | Narrow the token to a role. Repeatable                |
| `--profile <name>`    | `$ASPECT_AUTH_PROFILE`, else `default` | The auth profile whose Aspect Cloud credential to use |

Valid roles:

| Role                              | Grants                       |
| --------------------------------- | ---------------------------- |
| `checks.read`, `checks.write`     | Check runs                   |
| `statuses.read`, `statuses.write` | Commit statuses              |
| `prs.read`, `prs.write`           | Pull requests                |
| `issues.read`                     | Issues                       |
| `actions.read`                    | GitHub Actions runs and jobs |

The command fails when the App isn't linked to your account (HTTP 404) or the login lacks access to the repository (HTTP 403). Run `aspect auth login` again after a 401.