What shipped? GitHub now lets enterprise and organization admins revoke credentials by token type — PATs, SSH keys, OAuth tokens, and GitHub App user tokens — rather than nuking everything a user owns.
What changed? Previously, credential kill-switch actions applied to all of a user's credentials at once. Now you can:
- Token-type bulk deauthorization — revoke SSO authorizations for a specific credential type from the UI or the enterprise REST APIs, without touching SSH keys or OAuth tokens.
- Token-type bulk revocation — delete all credentials of a specific type for an individual user. Kill an EMU user's PATs but keep their SSH keys.
- Organization-level parity — all bulk credential-revocation actions previously at the enterprise level are now also available at the org level via UI and REST APIs.
- Audit logging — every action hits the audit log with email notifications to affected users.
Why does a builder care? If your org gets compromised, you no longer have to choose between blasting every credential and doing nothing. Surgical revocation means you contain the blast radius without shutting down the developers who weren't hit.