Create the token

1. Sign in to GitHub with the account that has access to the LIHG repositories.
2. Click your profile picture in the upper-right corner.
3. Select Settings.
4. Scroll down the left sidebar and select Developer settings.
5. Select:
   Personal access tokens → Fine-grained tokens
6. Click Generate new token. GitHub documents this exact navigation for fine-grained PAT creation.

Fill out the token

For Token name, I recommend:

UHD EOD Production Integration

For Description, use:

Read-only GitHub API access for UHD EOD repository, branch, commit, and pull request evidence synchronization.

For Expiration, I recommend starting with 90 days if that option is compatible with your organization's token policy. We can later establish a rotation procedure or replace this PAT with a GitHub App.

Resource owner — important

Under Resource owner, select your LIHG GitHub organization, presumably:

Lenox-International-Holdings-Group

Do not leave it set to your personal account if the repositories belong to the organization.

A fine-grained token can be restricted to resources owned by the selected organization. Depending on your organization's policies, a token created by an ordinary organization member may require owner approval; GitHub notes that fine-grained PATs created by organization owners do not require that approval under the default policy.

Repository access

Under Repository access, choose:

Only select repositories

Then select only the repositories UHD needs to monitor.

Based on the developer's configuration, the .env is designed to support multiple repositories:

UHD_EOD_GITHUB_REPOSITORIES=Lenox-International-Holdings-Group/LIHG,owner/another-repo

So select every actual repository that will appear in UHD_EOD_GITHUB_REPOSITORIES—and no others.

Do not choose All repositories unless there is a specific reason UHD needs every repository.

Repository permissions

This UHD integration is only reading GitHub information. It does not need permission to push code, merge PRs, modify branches, or administer repositories.

Under Repository permissions, give it:

Contents: Read is what allows the integration to retrieve repository content-related information such as commits and branches, while Pull requests: Read supports retrieving pull-request information. Fine-grained PAT permissions determine which REST API resources the token can access.

I would not grant:

Administration
Actions
Codespaces
Deployments
Environments
Issues
Secrets
Webhooks
Workflows
Contents: Read/Write
Pull Requests: Read/Write

unless we later discover a specific endpoint in the developer's implementation that requires something additional.

The EOD system should be read-only against GitHub.

Generate it

Once those settings are correct, click:

Generate token

GitHub will display the token.

It will look something roughly like:

github_pat_XXXXXXXXXXXXXXXXXXXXXXXX

Copy it immediately and store it securely.

That value is what becomes:

UHD_EOD_GITHUB_TOKEN=github_pat_XXXXXXXXXXXXXXXXXXXXXXXX

Do not put the real token into GitHub, README files, EOD reports, documentation, screenshots, or source code.

There is a second GitHub credential

Your developer actually needs two separate GitHub security values:

UHD_EOD_GITHUB_TOKEN=...
UHD_EOD_GITHUB_WEBHOOK_SECRET=...

They are not the same thing.

The PAT you are creating now allows:

UHD → GitHub

so UHD can retrieve repositories, branches, commits and pull requests.

The webhook secret protects:

GitHub → UHD

when GitHub sends push and pull_request webhook events to UHD.

So after you create this PAT, we should create the webhook secret separately. You do not obtain that secret from GitHub—we generate our own strong random secret and then put the same value in GitHub's webhook configuration and UHD's production .env.

Your final GitHub handoff will eventually look like this

# GitHub integration

UHD_EOD_GITHUB_REPOSITORIES=Lenox-International-Holdings-Group/REPOSITORY-NAME
UHD_EOD_GITHUB_TOKEN=<FINE_GRAINED_PAT>
UHD_EOD_GITHUB_WEBHOOK_SECRET=<SEPARATELY_GENERATED_SECRET>

I recommend that you do not send me the actual token once GitHub displays it. You can tell me, “I created it,” and I can walk you directly through the next screen/step while the credential stays private.

If you're at GitHub now, go to Settings → Developer settings → Personal access tokens → Fine-grained tokens → Generate new token. Once you reach the New fine-grained personal access token screen, tell me what you're seeing and I’ll walk you field-by-field through exactly what to select.