What scopes does a GitHub token need for a notification app?

Updated August 2026 · 3 min read

Menu bar apps like DevNotify need a GitHub personal access token to read your notifications. The golden rule: give the token the smallest access that works. For reading notifications, that means exactly one permission.

Creating the token, step by step

1. Open token settings. While signed in to GitHub, go to github.com/settings/personal-access-tokens.
2. Generate a new token. Click "Generate new token". Give it a name you'll recognize later, like devnotify-macbook.
3. Resource owner: leave it as yourself.
4. Repository access: choose "Public repositories" or "No access" — notification listing doesn't require repo contents access for this use.
5. Account permissions: set Notifications → Read-only. Leave everything else untouched.
6. Expiry: pick what suits you — 90 days is a sane default. You'll get an email before it expires.
7. Generate and copy. The token is shown once. Paste it straight into DevNotify's Preferences — it's stored locally on your Mac and sent only to api.github.com.

Fine-grained vs classic tokens

Classic tokens use coarse scopes like repo (full read/write of all your repositories) or notifications. If a classic token is all you can use, prefer the bare notifications scope — but fine-grained tokens are safer because they can't silently grant write access to your code.

Good token hygiene

• One token per app per device. If you stop using the app, revoke just that token instead of wondering what else breaks.
• Name tokens by purpose, so an unfamiliar token in your list is immediately suspicious.
• Read-only, always, unless an app documents why it needs more.
• Never paste a token into a website. A legitimate desktop app asks for the token in its own preferences window — not in a web form.