Read Only Access Token to a raw file from a Private repository.

[ArshakKroyan]

My apologies if "Code Security" is not the correct category I have chosen.

I have a private repository.
I want to share a link to a raw file to another application for using it as a config file.

I generate an use this kind of link: https://$TOKEN@raw.githubusercontent.com/<user or organization>/<repo name>/<branch>/<path to file>/<file_name>
Where the access token is a "Personal access tokens".

I need to check the "Repo" when generating the access token.

The problem is that I can not easily share that token to others.
Otherwise they can manage the repo.

Is there any "Personal access tokens" option that will only give a read access to a raw file?

P.S.
I know a public repo could solve the issue. But I need to keep it private.

[airtower-luna]

Is there any "Personal access tokens" option that will only give a read access to a raw file?

There isn't, and even if it did a read-only PAT would give access to all your private repositories, so it's probably not what you want.

The correct solution is to give the people who need to read that file read access to the repository, so they can use their own tokens.

As a side note, it's strongly recommended you send the token in an Authorization header instead of including it in the URL, as described here: https://docs.github.com/en/rest/overview/resources-in-the-rest-api#oauth2-token-sent-in-a-header

[ArshakKroyan]

Thank you @airtower-luna

[airtower-luna]

For completeness' sake, there's now a beta of PATs with more precise access settings: https://github.blog/2022-10-18-introducing-fine-grained-personal-access-tokens-for-github/

It's still not recommended to use that as a deployment option, as the article mentions, too. 😉

[ossanna16]

Hey there @ArshakKroyan and thank you for asking a good question! I'm glad you found our community 🙂

[vinixxvzy]

[ebndev]

Hi @vinixxvzy – it looks like your post included a secret, token, or credential. To help protect your security, we’ve deleted the content.

You should be receiving this notice as an email notification. Please avoid sharing secrets or credentials in public spaces like GitHub Community Discussions going forward, as they could be misused.

Thanks for helping us keep the community safe!