[piotrkaminski]

Agreed that their API is the most important thing, but IMHO they're not doing a particularly great job of it. You've got two separate API systems (REST and GraphQL) that overlap but with neither a superset of the other, two separate ID systems, no help in handling the wide range of incompatible API versions used by old GHE instances in the field, OAuth apps vs Apps that have different constraints on the APIs they're allowed to call and with no clear migration path between them, important bits of functionality used by their own UI that aren't available through the API at all, a convoluted API quota system, etc.

Frankly, a lot of it feels like they were trying to deprecate and replace an older system with the shiny new thing, then realized halfway through that they couldn't and now we're stuck with two somewhat incompatible ones for the foreseeable future. They could really use a strong tech lead on this.

[doctor_eval]

It feels this way with PATs as well, with legacy PATs still necessary for most of the things I use them for, despite being pushed into the newer ones. And the documentation is terrible. I had the exact same thought, the PAT transition feels like an unfinished feature as does the API transition.

For me the API transition is even more bizarre since it’s almost trivial to wrap REST calls with GraphQL.

What it feels like to me is a mounting level of serious technical debt which isn’t being addressed, and if that’s not a sign of trouble in a product like GitHub, I don’t know what is.

[Ayesh]

The only reason holding me from using granular PATs is that they _must_ have an expiration date and the maximum is one year.

[doctor_eval]

Yeah - I understand why they do this but I reckon they could have made them renewable without having to replace the tokens themselves.

Also granular PATs still don’t work everywhere.

[zx8080]

What is PAT?

[abraham]

https://docs.github.com/en/authentication/keeping-your-accou...

[EstanislaoStan]

Personal Access Token