API GitHub Meta

A big list of GitHub IPs and “keys” lands — devs cry “ELI5?” and one hero drops the docs

TLDR: GitHub published a public “Meta” list of its IP addresses and server keys so networks can safely recognize GitHub traffic and because passwords are disabled. The comments swung from confusion and ELI5 pleas to relief after someone shared the docs, debating whether it looked scary or was just normal housekeeping.

GitHub’s “Meta” API just served a buffet of numbers: IP ranges, server “fingerprints,” and SSH host keys. Translation for non-nerds: it’s a public cheat sheet telling networks how to recognize real GitHub traffic and not freak out. It even spells out that password logins are off — use tokens or SSH keys instead. The crowd’s first reaction? Confusion. One commenter squinted at the screen, “Chat, what do I see here?” and the replies turned into a chorus of “explain like I’m five” energy. Cue the memes about “numbers soup” and “keys to the kingdom” (they’re not — they’re how you verify GitHub’s servers, not your account).

Then came the calm: a commenter dropped the official docs, and the mood whiplashed from panic to “ohhh, that’s for firewalls and whitelists.” The split was clear: newcomers worried this looked sensitive, while old hands insisted it’s standard, safe, and meant to be public. The hottest debate boiled down to: “Why publish this?” versus “Because ops teams need it so your builds don’t break.” The funnies kept rolling — jokes about “IP-ocalypse,” and someone pretending they just hacked the Matrix by reading an IP list — but the consensus by the end was simple: it’s housekeeping data, not a heist. Still, nothing unites the internet like a scary wall of numbers.

Key Points

  • The JSON is a GitHub Meta API response containing operational metadata for connecting to GitHub services.
  • Password authentication is not verifiable on GitHub.com (verifiable_password_authentication=false).
  • Official SSH host key fingerprints for ECDSA, ED25519, and RSA are provided for identity verification.
  • Lists of SSH public host keys and service-specific IP ranges (hooks, web, api, git) are included for firewall allowlisting.
  • Additional IP ranges are given for GitHub Enterprise Importer and the packages service.

Hottest takes

"Chat, what do I see here?" — robertkoss
"Can someone ELI5?" — sidcool
"Official docs for this endpoint:" — alexgarcia-xyz
Made with <3 by @siedrix and @shesho from CDMX. Powered by Forge&Hive.