aws-amplify / aws-amplify/amplify-hosting

Raise accessToken length limit on CreateApp/UpdateApp for GitHub App installation tokens

Open
#4,106 1 comment 1 reaction 0 assignees View on GitHub
feature-request
Dominant language
Dockerfile
Stars
481
Forks
123
PR merge metrics
No merged PRs in 30d

Description

### Before opening, please confirm:

- [x] I have checked to see if my question is addressed in the [FAQ](https://github.com/aws-amplify/amplify-hosting/blob/master/FAQ.md).
- [x] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-hosting/issues?q=is%3Aissue+).
- [x] I have removed any sensitive information from my code snippets and submission.

### Amplify Hosting feature

Git providers

### Is your feature request related to a problem? Please describe:

GitHub is rolling out a new stateless installation-token format (ghs_APPID_JWT) for GitHub Apps, and now explicitly recommends downstream integrations support tokens of at least 520 characters (see GitHub's [changelog](https://github.blog/changelog/2026-05-15-github-app-installation-tokens-per-request-override-header/)):

> Database columns for token storage and header settings accept at least 520 characters
> Any token introspection or validation code treats ghs_ tokens as opaque strings

Amplify's accessToken field on CreateApp/UpdateApp has a maximum length of 255 characters (documented [here](https://docs.aws.amazon.com/amplify/latest/APIReference/API_CreateApp.html#amplify-CreateApp-request-accessToken)). Installation tokens issued to our GitHub App are now deterministically 383 characters — past Amplify's cap but under GitHub's own recommended 520 — so every CreateApp/UpdateApp call using a GitHub App installation token now fails:

> ValidationException: Value at 'accessToken' failed to satisfy constraint:
> Member must have length less than or equal to 255

This breaks GitHub-App-based repo connection entirely, with no workaround available to the caller. We're currently using GitHub's temporary `X-GitHub-Stateless-S2S-Token`: disabled override header to force GitHub to keep issuing the legacy 40-character format, but GitHub has stated this override will eventually stop being honored, with no announced date — at which point this breaks again with no fix available on our end.

### Describe how you'd like this feature to work

Raise the accessToken maximum length on CreateApp/UpdateApp to at least 520 characters, matching GitHub's own documented guidance for downstream integrations. More specifically:

- Treat the accessToken value as an opaque string with no hardcoded length or format assumptions, rather than raising the cap to a single new fixed number that could be outgrown again the next time a git provider changes its token format.
- Confirm this doesn't require any other downstream changes on AWS's side (e.g., database column sizes for any persisted credentials).

https://github.blog/changelog/2026-05-15-github-app-installation-tokens-per-request-override-header/#:~:text=A%20stateless%20token%20is,tokens%20as%20opaque%20strings

Contributor guide

Open the contributing guide

Research direction

The issue identifies the CreateApp and UpdateApp API operations and the accessToken validation limit, but names no repository files or tests. Start by locating those API definitions and the credential-storage path; done means both operations accept the required token size and treat the value as opaque without downstream storage failures.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, github
Domain
api, backend
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.