TigerGate scans your GitHub organization’s security posture (branch protection, member permissions, repo visibility, org-level security settings, and more) via a personal access token.
Use a read-only token. TigerGate only reads posture data — with a read-only token it can never change repository settings, org settings, or membership.

​
Before you start

In TigerGate, go to Integrations → Cloud Providers and add a GitHub connection. The form has three fields:
FieldWhat it is
Connection NameA label for this connection (e.g. GitHub Org).
Personal Access TokenA token with read:org + repo (read) scopes.
Organization (optional)Restricts the connection to a single org — leave blank to use whatever the token can access.

​
1. Create the token

1

Open GitHub token settings

Go to GitHub → Settings → Developer settings → Personal access tokens. A fine-grained token is preferred; a classic token works too.
2

Grant read-only scopes

Fine-grained token: grant the target organization, then set Administration, Members, and Metadata permissions to Read-only.Classic token: select read:org and repo (repo is required to read branch-protection rules — TigerGate never writes to repos).
3

Copy the token

GitHub shows the token (ghp_… or github_pat_…) once. Copy it — you’ll paste it into TigerGate next.

​
2. Connect it in TigerGate

1

Paste the token

In Integrations → Cloud Providers, open the GitHub connection and paste the token into Personal Access Token. Set Organization if you want to restrict the connection to one org.
2

Test

Click Test. TigerGate calls the GitHub API (GET /user) to confirm the token authenticates. A bad, expired, or revoked token fails here with the GitHub status code. Test checks only that the token is valid — it does not verify organization access or scopes; those are exercised when a scan runs.
3

Scan or schedule

Run an on-demand scan, or add a recurring Schedule under Cloud Security → Schedules for this account.

​
Troubleshooting

ErrorWhenCauseFix
401 / Bad credentialsTest and scanToken is wrong, expired, or revokedGenerate a new token
403 on org-level checksScanMissing read:org (classic) or Members/Administration read (fine-grained)Re-generate the token with the scopes in step 2
Organization not foundScanOrganization field doesn’t match the org’s exact slug, or the token can’t see itCheck the org slug in the GitHub URL; confirm the token was authorized for that org (fine-grained tokens require explicit org access, and org owners may need to approve it)
Scan runs but few findingsScanToken only has repo but not read:orgAdd read:org (classic) or Members read (fine-grained)