Unfortunately this only seems to be available for repos you own yourself and not if an org owns the repo, making it useless in a company context until that is expanded. Great for personal stuff tho.

They work, but the organization needs to approve the token (and its scope). As the org manager, I prefer it this way because I can audit what access developers give out to what repositories.

The new tokens are still in Beta, so there are some other limitations: for example, GitHub Packages do not support them yet, so you cannot use them in Yarn/NPM to get private packages hosted on GitHub.

Doesn't this rather defeat the point? If using a PAT is simpler than using the org token then I'll just use a PAT that has access to every single repository in the org.

GitHub Org admins have the option to block all regular PATs, and only allow fine-grained tokens that they pre-approve. This block is “off” by default, but I expect the best practice soon will be to enforce this rule.

Oh, aside from the pre-approval, that would be really nice. I need stuff scoped to the org that is not necessarily connected to my personal account (and all it’s repositories).

Fine-grained access tokens are available on org-owned repos too, but the org has to opt in (for some reason).

GitLab has had this feature for years.

I'm excited for FGPATs, but they're still in beta and still have a lot of shortcomings at this time.