Check out GitHub code without long-lived credentials on self-hosted agents

You can now check out private GitHub repositories on self-hosted agents without distributing and rotating SSH keys or personal access tokens across your fleet. Buildkite supplies temporary, read-only GitHub App tokens for checkout, so a new machine, container, or Kubernetes pod doesn't need its own repository credential.

The option is available to all customers and is off by default. In your self-hosted queue's Settings, enable Use GitHub App token for checkout and select Save Queue. You'll need Buildkite agent v3.63.1 or later and the full-access Buildkite GitHub App integration installed with access to your repositories. The Limited Access integration doesn't provide code access.

Each token grants read-only contents access to one requested repository and expires one hour after GitHub issues it. The agent retrieves credentials automatically: there's no GitHub App private key or token-generation hook to install on your agents. This supplies checkout credentials, not a token for pushing commits or general-purpose GitHub API access.

GitHub.com pipelines can keep their existing SSH repository URLs; checkout uses HTTPS automatically. GitHub Enterprise Server is supported too, with code read access enabled on its GitHub App and an HTTPS repository URL in the pipeline.

You can also manage the queue setting through the REST API, GraphQL, or Terraform (Buildkite provider v1.43.0 or later). On existing agents, record your Git configuration before enabling it: the credential helper and GitHub.com URL rewrite persist after jobs finish.

Try it on one self-hosted queue, run a build, and check that checkout succeeds over HTTPS. The self-hosted code access guide covers setup, token scope, and switching from existing credentials.