In order to allow your GitHub Actions workflow to authenticate with your
Teleport cluster, you'll first need to create a join token. These tokens set out
criteria by which the Auth Server decides whether or not to allow a bot or node
to join.

To create a token, we can write the resource's YAML to a file on disk, and then
use `tctl` to apply it.

Create a file named `tokenconfig.yaml` and insert the following contents:

<Tabs>
<TabItem label="GitHub">

```yaml
kind: token
version: v2
metadata:
  name: github-token
spec:
  roles: [Bot]
  join_method: github
  bot_name: github-demo
  github:
    allow:
      - repository: gravitational/example
```

</TabItem>
<TabItem label="GitHub Enterprise Server">
From Teleport 11.1.4, users with Teleport Enterprise are able to permit
workflows within GitHub Enterprise Server instances to authenticate using the
GitHub join method.

This is configured by an additional `enterprise_server_host` field in the Token
resource. This should be set to the host of your GHES instance.

```yaml
kind: token
version: v2
metadata:
  name: github-token
spec:
  roles: [Bot]
  join_method: github
  bot_name: github-demo
  github:
    enterprise_server_host: your.ghes.instance.example.com
    allow:
      - repository: gravitational/example
```

</TabItem>
</Tabs>

Let's go over the token resource YAML's fields in more detail:

- `metadata.name` defines the name of the token. Note that this value will need
to be used in other parts of the configuration later.
- `metadata.expires` defines the date that the join token will expire. This
example is set to the year `2100`.
- `spec.bot_name` is the name of the Machine ID bot that this token will grant
access to. Note that this value will need to be used in other parts of the
configuration later.
- `spec.roles` defines which roles that this token will grant access to. The
value of `[Bot]` states that this token grants access to a Machine ID bot.
- `spec.join_method` defines the join method the token is applicable for. Since
this guide only focuses on GitHub Actions, we will set this to to `github`.
- `spec.github.allow` is used to set rules for what GitHub Actions will be able
to authenticate by using the token. In this example, the `gravitational/example`
repository is used, and this example repository should be replaced with your own
repo.

You can find a full list of the token configuration options for GitHub Actions
joining on the
[GitHub Actions reference page.](../../machine-id/reference/github-actions.mdx#github-join-token)

Once the resource file has been written, create the token with `tctl`:

```code
$ tctl create -f tokenconfig.yaml
```

Check that token `github-token` has been created with the following
command:

```code
$ tctl tokens ls
Token       Type Labels Expiry Time (UTC)
----------- ---- ------ ----------------------------------------------
github-token Bot         01 Jan 00 00:00 UTC (2562047h47m16.854775807s)
```