> For the complete documentation index, see [llms.txt](https://docs.mobb.ai/mobb-user-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.mobb.ai/mobb-user-docs/more-info/update-broker-token/github-enterprise-server-pat.md).

# GitHub Enterprise Server — PAT

{% hint style="warning" %}
This guide applies **only to on-premises Mobb deployments** where the [Mobb Broker](/mobb-user-docs/more-info/mobb-broker.md) is used to connect to a self-hosted GitHub Enterprise Server (GHES) instance.
{% endhint %}

## Overview

When Mobb connects to an on-premises GitHub Enterprise Server through the Mobb Broker using **Personal Access Token (PAT)** authentication, it requires a valid GitHub PAT to interact with the GitHub API. This guide explains how to generate a new PAT and update it in Mobb.

## Prerequisites

* Access to a Mobb on-premises deployment with the Mobb Broker configured for GitHub Enterprise Server
* Permission to create a Personal Access Token in your GitHub Enterprise Server instance
* Access to Mobb under your organization

## Steps

### Step 1: Generate a New GitHub Personal Access Token

1. Log in to your GitHub Enterprise Server instance under your account.
2. Click your **user icon** in the top-right corner and select **Settings**.
3. In the left sidebar, select **Developer settings**.
4. Select **Fine-grained tokens**, then click **Generate new token**.

   <figure><img src="/files/30PDPN0NuDeLvZP5KAoJ" alt="GitHub Enterprise Server Fine-grained tokens page"><figcaption><p>Developer settings → Fine-grained tokens → Generate new token</p></figcaption></figure>
5. Give the token a descriptive **name** (for example, `Mobb Broker`), select the **Resource owner** (the organization that owns the repositories Mobb will scan), and set an **Expiration** date.
6. Under **Repository access**, select **All repositories** (or **Only select repositories** if you want to limit Mobb to specific repositories).
7. Under **Permissions → Repository permissions**, grant the following access levels:

   | Permission        | Access         |
   | ----------------- | -------------- |
   | **Contents**      | Read and write |
   | **Pull requests** | Read and write |
   | **Workflows**     | Read and write |

   The **Metadata** permission is set to **Read-only** automatically and is required.

   <figure><img src="/files/U2ZKnwYdp85NQ94VlTmi" alt="Fine-grained token repository access and permissions"><figcaption><p>Set the repository access, then set Contents, Pull requests, and Workflows to <strong>Read and write</strong></p></figcaption></figure>
8. Click **Generate token** and copy the generated token value. You will not be able to view it again after leaving this page.

{% hint style="info" %}
If fine-grained tokens are not enabled on your GitHub Enterprise Server version, generate a **classic** Personal Access Token instead (**Developer settings → Tokens (classic) → Generate new token**) and select the `repo` and `workflow` scopes.

<img src="/files/D2fSC3fTIuY5l6xRzY4W" alt="Classic token alternative — select the repo and workflow scopes" data-size="original">
{% endhint %}

### Step 2: Update the Token in Mobb

1. In the Mobb interface, click the **Integrations** icon in the left sidebar.
2. Locate **GitHub Enterprise Server** under the **Hosted Code Platforms** section and click **Configure**.

   <figure><img src="/files/rYcjB7FfONpTD3uuJ6iy" alt="Mobb Hosted Code Platforms — GitHub Enterprise Server card"><figcaption><p>Locate GitHub Enterprise Server and click Configure</p></figcaption></figure>
3. In the **Configure GitHub Enterprise Server** dialog, click your **GitHub Enterprise Server URL** in the list.

   <figure><img src="/files/KO0bbJlXVZlPFmOUCUe3" alt="Configure GitHub Enterprise Server — select your instance URL"><figcaption><p>Select your GitHub Enterprise Server URL</p></figcaption></figure>
4. Paste your new GitHub Personal Access Token into the **GitHub Enterprise Server access token** field and click **Connect**.

   <figure><img src="/files/bkFil3eIE6ZDT6OefXVu" alt="Enter the GitHub Enterprise Server access token"><figcaption><p>Paste your GitHub PAT and click Connect</p></figcaption></figure>

### Step 3: Verify the Connection

After updating the token, verify that Mobb can successfully connect to your GitHub Enterprise Server:

1. On the configuration screen, you should see a **"Connected"** status indicating successful authentication.
2. You can also verify by returning to the **Integrations** page—the GitHub Enterprise Server integration should display a **Connected** checkmark.

## Troubleshooting

If you see connection errors, verify that:

* The token has not expired
* The token has the correct permissions (Contents, Pull requests, and Workflows set to **Read and write**)
* The resource owner and repository access include the repositories Mobb needs to scan
* Your GitHub Enterprise Server is reachable from the Mobb Broker network

### Verify Mobb Broker Connectivity

To verify that the Mobb Broker can reach your GitHub Enterprise Server, you can use the [Mobb REST API to check SCM connection status](https://apidocs.mobb.ai/mobb-rest-api#tag/broker-management/get/api/rest/checkscmconnectionstatus):

```bash
GET /api/rest/checkscmconnectionstatus
```

This endpoint will return the current connection status of your Mobb Broker to the SCM. If the broker cannot reach GitHub Enterprise Server, reach out to us via <support@mobb.ai>.