---
title: "Grant credential authorizations for enterprise organizations"
method: POST
path: "/enterprises/{enterprise}/credential-authorizations"
tags: ["enterprise-admin"]
---

# Grant credential authorizations for enterprise organizations

`POST /enterprises/{enterprise}/credential-authorizations`

Authorizes an existing user credential for selected organizations in an enterprise. Currently supports personal access tokens (classic)
and user-owned SSH authentication keys.
The authenticated GitHub App must be owned by the enterprise or an organization in the enterprise. The credential
owner must be a member of every selected organization, and the enterprise must be configured with
an enterprise-level SSO provider.

Credential authorizations remain active if the GitHub App is uninstalled or loses permission. They
remain active until explicitly revoked, the credential is revoked or deleted, or the credential
owner loses organization membership.

## Path parameters

- `enterprise` string, required

## Request body

- union
  - object
    - `credential_id` integer, required — The token ID of the personal access token (classic) to authorize.
    - `credential_type` 'classic_pat', required
    - `organizations` string[], required — Organization slugs within the enterprise. A maximum of 50 organizations can be specified.
  - object
    - `credential_id` string, required — The SHA-256 fingerprint of the user-owned SSH authentication key to authorize.
    - `credential_type` 'ssh_key', required
    - `organizations` string[], required — Organization slugs within the enterprise. A maximum of 50 organizations can be specified.

## Response `201`

Credential authorizations were granted.

- union
  - object
    - `credential_id` integer, required
    - `credential_type` 'classic_pat', required
    - `organizations` string[], required
  - object
    - `credential_id` integer, required
    - `credential_type` 'ssh_key', required
    - `fingerprint` string, required — The SHA-256 fingerprint of the authorized SSH key.
    - `organizations` string[], required

## Other responses

- `403` — Forbidden
- `404` — Resource not found
- `409` — Conflict. Returned when credential authorizations are being modified by another request.
- `422` — Validation failed, or the endpoint has been spammed.

## Changes

- **2026-09-17** (2026-03-10) `43ddf0e71e7c` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/github/apis/enterprise-cloud/changes/enterprises/:enterprise/credential-authorizations/post.md)

---

[API](https://skmtc.dev/github/apis/enterprise-cloud.md) · [All operations](https://skmtc.dev/github/apis/enterprise-cloud/llms.txt) · [OpenAPI document](https://skmtc.dev/github/apis/enterprise-cloud/revisions/f2fe1bb39903?raw)