aws-amplify / aws-amplify/amplify-hosting
Raise accessToken length limit on CreateApp/UpdateApp for GitHub App installation tokens
- Dominant language
- Dockerfile
- Stars
- 481
- Forks
- 123
- PR merge metrics
- No merged PRs in 30d
Description
### Before opening, please confirm:
- [x] I have checked to see if my question is addressed in the [FAQ](https://github.com/aws-amplify/amplify-hosting/blob/master/FAQ.md).
- [x] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-hosting/issues?q=is%3Aissue+).
- [x] I have removed any sensitive information from my code snippets and submission.
### Amplify Hosting feature
Git providers
### Is your feature request related to a problem? Please describe:
GitHub is rolling out a new stateless installation-token format (ghs_APPID_JWT) for GitHub Apps, and now explicitly recommends downstream integrations support tokens of at least 520 characters (see GitHub's [changelog](https://github.blog/changelog/2026-05-15-github-app-installation-tokens-per-request-override-header/)):
> Database columns for token storage and header settings accept at least 520 characters
> Any token introspection or validation code treats ghs_ tokens as opaque strings
Amplify's accessToken field on CreateApp/UpdateApp has a maximum length of 255 characters (documented [here](https://docs.aws.amazon.com/amplify/latest/APIReference/API_CreateApp.html#amplify-CreateApp-request-accessToken)). Installation tokens issued to our GitHub App are now deterministically 383 characters — past Amplify's cap but under GitHub's own recommended 520 — so every CreateApp/UpdateApp call using a GitHub App installation token now fails:
> ValidationException: Value at 'accessToken' failed to satisfy constraint:
> Member must have length less than or equal to 255
This breaks GitHub-App-based repo connection entirely, with no workaround available to the caller. We're currently using GitHub's temporary `X-GitHub-Stateless-S2S-Token`: disabled override header to force GitHub to keep issuing the legacy 40-character format, but GitHub has stated this override will eventually stop being honored, with no announced date — at which point this breaks again with no fix available on our end.
### Describe how you'd like this feature to work
Raise the accessToken maximum length on CreateApp/UpdateApp to at least 520 characters, matching GitHub's own documented guidance for downstream integrations. More specifically:
- Treat the accessToken value as an opaque string with no hardcoded length or format assumptions, rather than raising the cap to a single new fixed number that could be outgrown again the next time a git provider changes its token format.
- Confirm this doesn't require any other downstream changes on AWS's side (e.g., database column sizes for any persisted credentials).
https://github.blog/changelog/2026-05-15-github-app-installation-tokens-per-request-override-header/#:~:text=A%20stateless%20token%20is,tokens%20as%20opaque%20strings
Contributor guide
Research direction
The issue identifies the CreateApp and UpdateApp API operations and the accessToken validation limit, but names no repository files or tests. Start by locating those API definitions and the credential-storage path; done means both operations accept the required token size and treat the value as opaque without downstream storage failures.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, github
- Domain
- api, backend
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100