Enhancing Enterprise Security Visibility

GitHub has officially launched a new capability within its platform that enables enterprise owners to generate a comprehensive inventory of every credential capable of accessing their environment. According to the official [GitHub Changelog](https://github.blog/changelog/2026-09-21-github-enterprise-adds-credential-inventory-exports/), this release covers a wide range of authentication methods, including SSH keys, classic and fine-grained personal access tokens, OAuth App access tokens, and GitHub App user-to-server and installation tokens.

This functionality serves as a single plane of view for administrators, allowing them to oversee credentials owned by both members and integrated applications. By centralizing this data, organizations can significantly improve their security posture, particularly when assessing the total risk surface area across large-scale deployments.

Streamlining Incident Response and Remediation

In the event of a security incident, the ability to rapidly identify compromised access points is critical. This new feature allows security teams to correlate credentials with audit log activity, providing deeper insights into usage patterns and potential exposure. Detailed documentation on [reviewing credentials in your enterprise](https://docs.github.com/enterprise-cloud@latest/admin/managing-iam/respond-to-incidents/reviewing-credentials-in-your-enterprise) provides further guidance for administrators tasked with planning remediation and communication strategies during security events.

Flexible Access and Reporting Options

GitHub has designed the tool to be accessible through two primary channels. Enterprise owners and members with the 'View enterprise credentials' permission can manually export an inventory CSV directly from the enterprise settings menu. Specifically, the 'Export CSV' option is now located under Settings, within the Authentication Security and Credentials section.

For organizations requiring automated reporting or integration with internal security dashboards, GitHub has also introduced a specialized [Rest API to export credential inventory](https://docs.github.com/enterprise-cloud@latest/rest/enterprise-admin/token-inventory?apiVersion=2026-03-10#list-enterprise-token-inventory). This programmatic access allows teams to filter results by specific criteria such as user, app, credential type, or organization, and review metadata including creation, expiration, and last-used dates.

Availability and Future Support

The credential inventory export feature is currently available for users of GitHub Enterprise Cloud. The company has confirmed that support for this feature will be extended to upcoming releases of GitHub Enterprise Server. This update follows a series of recent improvements to developer and enterprise tools, such as the ability to [manage the code coverage ruleset condition with the REST API](https://github.blog/changelog/2026-09-18-manage-the-code-coverage-ruleset-condition-with-the-rest-api), further signaling GitHub's ongoing focus on enhancing administrative control and security management.

Sources

• GitHub ChangelogGitHub Enterprise adds credential inventory exports