Update authentication documentation for token formats (#61272)

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: sunbrye <sunbrye@github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: 5 people

content/apps/creating-github-apps/authenticating-with-a-github-app/generating-an-installation-access-token-for-a-github-app.md

@@ -19,6 +19,8 @@ In order to authenticate as an app installation, you must generate an installati
 
 You should keep your installation access token secure. For more information, see [AUTOTITLE](/apps/creating-github-apps/setting-up-a-github-app/best-practices-for-creating-a-github-app).
 
+{% data reusables.apps.ghs-stateless-token-format %}
+
 ## Generating an installation access token
 
 {% data reusables.apps.generate-installation-access-token %}

content/authentication/keeping-your-account-and-data-secure/about-authentication-to-github.md

@@ -145,6 +145,8 @@ To use a {% data variables.product.pat_generic %} or SSH key to access resources
 
 {% data variables.product.company_short %} issues tokens that begin with a prefix to indicate the token's type.
 
+{% data reusables.apps.ghs-stateless-token-format %}
+
 | Token type | Prefix | More information |
 | :- | :- | :- |
 | {% data variables.product.pat_v1_caps %} | `ghp_` | [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token#creating-a-personal-access-token-classic)  |
@@ -154,4 +156,4 @@ To use a {% data variables.product.pat_generic %} or SSH key to access resources
 | Installation access token for a {% data variables.product.prodname_github_app %} | `ghs_` | [AUTOTITLE](/apps/creating-github-apps/authenticating-with-a-github-app/authenticating-as-a-github-app-installation) |
 | Refresh token for a {% data variables.product.prodname_github_app %} | `ghr_` | [AUTOTITLE](/apps/creating-github-apps/authenticating-with-a-github-app/refreshing-user-access-tokens) |
 
-For more information {% data variables.product.github %}'s token types and their management, see [AUTOTITLE](/organizations/managing-programmatic-access-to-your-organization/github-credential-types).
+For more information {% data variables.product.github %}'s token types and their management, see [AUTOTITLE](/organizations/managing-programmatic-access-to-your-organization/github-credential-types).

data/reusables/apps/ghs-stateless-token-format.md

@@ -0,0 +1,2 @@
+> [!NOTE]
+> Starting April 27, 2026, {% data variables.product.github %} began a staged rollout of a stateless format (`ghs_APPID_JWT`) to all newly minted {% data variables.product.prodname_github_app %} installation tokens, making them more performant and improving the reliability of our API surface. If your application expects or relies on installation tokens being exactly 40 characters long, it may not handle this new token format correctly. You can now validate your apps and workflows using a temporary request header that lets you enable the token format on demand. For more information about the temporary header, see [the {% data variables.product.company_short %} blog](https://github.blog/changelog/2026-05-15-github-app-installation-tokens-per-request-override-header).