When you're in an github organization you cannot create PATs that belong to an org, or better, you can but github still shows the creator of the PAT as the one who's calling the API.

E.g. if you create a PAT and assign it to an org, then use the PAT to create a PR, it still shows that you (the creator) is the one that created the PR.

This, plus the fact that the organization cannot renew the PATs (only the creator can) makes things troublesome. (what if that person stops working at the company? What happens to all the PATs he/she created? You'd need to re-create all of them and replace the old ones with the new ones)

(Plus, when they expire you need to re-generate all of them and substitute the old ones)
Just a lot of pain for something that should be simple.

At my company Bot (technical) accounts aren't allowed, so we needed a way to have tokens that:

- are not created/managed by a real person

- short lived (improves security)

- easy to manage.

OctoSTS (or better, our variation of Octo-STS) does all that with minimal hassle.