DOCT-1903: clarify PAT type and add Billing Admin guidance for Snyk Essentials GitHub setup

[mihaisau-snyk]

Related ticket

DOCT-1903

What changed

On GitHub for Snyk Essentials:

• Clarified that a classic personal access token (PAT) is required — fine-grained PATs are not supported (stated up front, in addition to the existing hint further down the page).
• Added guidance to generate the PAT from a GitHub Billing Admin account, so Snyk Essentials can see every downstream organization in the account and the token doesn't break when an employee leaves.
• Fixed a broken prerequisites link that pointed to the GitHub Enterprise (org-level) permissions section instead of the Snyk Essentials-specific one.

Out of scope for this PR

The requester (Jamie Meredith) confirmed the eng team needs to weigh in on how the PAT's permissions are actually used before we can accurately describe them, specifically:

• Whether the repo scope's write access is used by Essentials at all.
• Whether the existing line "the user associated with the token needs write permissions on relevant repositories to collect a breakdown of scan issues" is still accurate.

These are being tracked in a follow-up Jira ticket rather than blocking this PR. The permissions reference page (user-permissions-and-access-scopes.md#github-for-snyk-essentials) also needs a matching update but is handled separately once that's resolved.

---

Note

Low Risk
Documentation-only changes to integration setup guidance; no product code or security logic is modified.

Overview
Updates GitHub for Snyk Essentials setup docs so admins use the right token type and account, and land on the correct permissions page.

The integration section now states upfront that Group-level GitHub integrations require a classic PAT, not a fine-grained PAT. The PAT generation section adds guidance to create the token from a GitHub Billing Admin account so Essentials can reach downstream orgs in the account and the token is less likely to break when a user leaves.

The prerequisites link now targets GitHub for Snyk Essentials permission requirements instead of the generic GitHub Enterprise org-level section.

^{Reviewed by Cursor Bugbot for commit 168532b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[cursor]

AI review

The technical facts hold up and the guidance clarifies the token requirements for Snyk Essentials. I verified the target anchor #github-for-snyk-essentials in developer-tools/scm-integrations/user-permissions-and-access-scopes.md and confirmed all relative links resolve.

No structural defects found. I have included two minor style recommendations below as one-click suggestions.

Style fixes (folded into the suggestions)

Apply sentence case to the PAT generation heading · bold the UI element Personal access tokens in the PAT instructions.

One thing to confirm

⚠️ The PR description notes that SME confirmation is pending on DOCT-1903 regarding whether write permissions are required on repositories. The permissions reference page user-permissions-and-access-scopes.md will also need alignment once confirmed.

  

_{Sent by Cursor Automation: PR review for User Docs}

[cursor]

Use sentence case for heading. (Snyk style guide)

Capitalize only the first word and proper nouns in headings. "Personal" is a common noun in this context.

Suggested change

	## Generate a Personal access token from your GitHub settings
	## Generate a personal access token from your GitHub settings

[cursor]

Bold UI element. (Snyk style guide)

Bold UI elements and settings options in procedures.

Suggested change

	3. Select Personal access tokens and then Tokens (classic).
	3. Select **Personal access tokens** and then **Tokens (classic)**.

[cursor]

The current head commit bba1638 is reviewed.

  

_{Sent by Cursor Automation: PR review for User Docs}