Given an app id and secret (pem), how can I get an access token for a repo my app is installed at via a shell script?
This script is what you are looking for. It uses only open-ssl, jq and curl.
You can either get a token only for a given repo or all repos the app is installed to.