GitHub announced on April 24, 2026 that installation access tokens for GitHub Apps are changing format . Starting with a brownout mid-May 2026 and full cutover by late June 2026, tokens will grow from the current 40 characters ( ghs_ + 36 chars) to up to roughly 520 characters. The prefix stays ghs_ . The character set stays the same. Only the length changes — and only upward, and only sometimes. That last part is the trap. During and after the rollout, some tokens will still be 40 chars (issued before the change, cached, returned by older Enterprise Server versions) and some will be 200, 380, 520. The same App, same installation, same call, on different days returns different lengths. There's no transition flag. There's no version header. The token still parses as bytes. It just doesn't fit anywhere you assumed it would. The four shapes of the failure # All four of these silently corrupt or reject valid tokens after May 2026. # 1. Database column too narrow.…