Expanded permissions for the Expo GitHub bot

Date: March 3, 2026
Author: Dan Kelly

Overview

You may have received (or will soon receive) an email from GitHub asking you to approve updated permissions for the Expo GitHub App. This is a legitimate request from Expo.

Action required: Click approve when you see the GitHub email.

Why we're requesting new permissions

Expo is building new features for the Expo GitHub App, and GitHub's permission model requires apps to request expanded access before using new API capabilities. Expo needs "Repository Administration" access to enable automatic EAS project setup for new and existing repositories.

Specific feature details will be shared as they roll out.

What the Expo GitHub App does today

The Expo GitHub App connects GitHub repositories to EAS. When installed and linked to an Expo project, it enables:

• Triggering EAS Workflows from pushes, pull requests, and tags
• Posting workflow results (like build and update links) as GitHub PR comments
• Reading your repository contents to run builds and updates on EAS

These existing features will continue to work regardless of whether you approve the new permissions.

What happens if you don't approve

Nothing breaks. If you choose not to approve the updated permissions, your current EAS Workflows, builds, and updates will continue to function normally. You can also set up a new Expo account, connect it to an existing GitHub project, and run workflows without issue.

The only limitation is access to new agentic features as they become available. Permissions can be approved later when ready.

A note for enterprise teams

Organizations with strict access policies should know:

• The new permissions are additive. They don't change how existing features work or what data they access.
• You can leave them off. Every current integration (EAS Workflows, builds, updates, PR comments) works without the new permissions.
• You can approve later. There's no deadline. Evaluate new features when they ship and approve at that point.

For questions about specific permission scopes, contact security@expo.dev or Discord.