We similarly deprecated password auth on our API previously. We used to allow basic auth over HTTPS. Two issues: * users will ultimately hard code the passwor

We similarly deprecated password auth on our API previously. We used to allow basic auth over HTTPS. Two issues: * users will ultimately hard code the passwords in a script * the user may have used the same password on other sites Combine the above together and it can result in a bad situation. It's best for a vendor (like GitHub) to encourage good security, where possible. A token which is unlinked to the password and can be revoked independently of the password adds minimises the extend of the compromise.