-
Sign in to GitHub and open Developer settings
You
Needs you because: login or mfa
- Sign in to the GitHub account that will own the app (personal account, or an org you administer).
- Go to profile picture > Settings > Developer settings > OAuth apps.
https://github.com/settings/developers
Expected: You see the OAuth apps list with a New OAuth App button (Register a new application on first use).
~2 min · Agent has not attempted this step c5c59
-
Decide app type and owner
You
Needs you because: developer decision
- GitHub's docs recommend a GitHub App over an OAuth app for fine-grained permissions and short-lived tokens; pick OAuth app only if you need it (for example enterprise-level resources).
- Choose the owning account: personal account, or an organization you administer. Each owner can hold up to 100 OAuth apps.
Expected: You know which account will own the app and why you chose OAuth app.
~5 min · Agent has not attempted this step c1c3c4c50
-
Fill in the registration form
Agent
- Provide an application name, a full homepage URL and an authorization callback URL. Description is optional.
- Keep everything public-safe: no internal URLs or sensitive data.
- Add up to 10 callback URLs if you need more than one.
- Check Enable Device Flow if your agent uses the device flow.
Authorization callback URLhttps://YOUR-APP.example/oauth/callback
Expected: Form is complete and ready to submit.
~10 min · Agent has not attempted this step c6c7c8c9
-
Submit registration and copy credentials
You
Needs you because: legal acceptance
- Click Register application.
- Copy the client ID and generate a client secret; store them outside the repo.
Expected: App appears in the OAuth apps list with a client ID and secret.
~3 min · Agent has not attempted this step c5c6
-
Choose token expiry setting
You
Needs you because: developer decision
- Expire user access tokens is on by default. Leave it on if your client supports refresh tokens (8-hour access token, refresh token valid 6 months unused).
- Uncheck it only if your auth code cannot handle short-lived tokens yet.
Expected: Token expiry setting matches what your client can handle.
~5 min · Agent has not attempted this step c10c11c12
-
Get organization approval for the app
You
Only for: OAuth app owned by an organization, or used against org resources with access restrictions
Needs you because: third party action
- If the org has OAuth app access restrictions, members and outside collaborators cannot authorize the app against org resources; a member requests owner approval and owners are notified.
- If an organization application policy is active, only an org owner can authorize the installation; a member can request it and an owner approves or denies.
- Note restrictions are on by default for newly created organizations.
Expected: An org owner has approved the app, or the org has no restrictions in place.
Agent has not attempted this step c37c38c39c40
-
Have a user authorize the app
You
Needs you because: login or mfa
- A user must interactively authorize the app to get a user access token; requested scopes are shown on the authorization form.
- Users can grant fewer scopes than requested.
Expected: User access token issued with the granted scopes.
~3 min · Agent has not attempted this step c28c30c45c46
Live generation reads public documentation and sends unauthenticated requests only. It does not sign in, create an app, or submit anything.
59 claims behind this guide.
- c1 Official docs high confidence
GitHub's official docs recommend building a GitHub App instead of an OAuth app, because GitHub Apps use fine-grained permissions, give users more control over repository access, and use short-lived tokens.
Creating an OAuth app - GitHub Docs retrieved 2026-10-27Consider building a GitHub App instead of an OAuth app. ... GitHub Apps use fine-grained permissions, give the user more control over which repositories the app can access, and use short-lived tokens.
- c2 Unverified low confidence
GitHub states that GitHub Apps are generally preferred over OAuth apps because they use fine-grained permissions, give more control over which repositories the app can access, and use short-lived tokens.
- c3 Official docs high confidence
An OAuth app can be created and registered under a personal account or under any organization the developer has administrative access to.
Creating an OAuth app - GitHub Docs retrieved 2026-10-27You can create and register an OAuth app under your personal account or under any organization you have administrative access to.
- c4 Official docs high confidence
A user or organization can own up to 100 OAuth apps.
- c5 Official docs high confidence
An OAuth app is registered through the profile picture > Settings > Developer settings > OAuth apps, then clicking New OAuth App (labeled Register a new application for first-time users).
- c6 Official docs high confidence
Registering an OAuth app requires an application name, a full homepage URL, and an authorization callback URL; the description is optional.
Creating an OAuth app - GitHub Docs retrieved 2026-10-27In "Homepage URL", type the full URL to your app's website.
Optionally, in "Application description", type a description of your app that users will see.
In "Authorization callback URL", type the call
- c7 Official docs high confidence
An OAuth app can have up to 10 callback URLs, added via Add callback URL.
- c8 Official docs high confidence
GitHub warns that only information considered public should be used in an OAuth app, avoiding sensitive data such as internal URLs.
Creating an OAuth app - GitHub Docs retrieved 2026-10-27Only use information in your OAuth app that you consider public. Avoid using sensitive data, such as internal URLs, when creating an OAuth app.
- c9 Official docs high confidence
For OAuth apps using the device flow, the Enable Device Flow option must be checked when registering the app.
- c10 Official docs high confidence
Expire user access tokens is enabled by default for OAuth apps; apps whose authentication code does not yet support short-lived tokens should uncheck it until support is added.
Creating an OAuth app - GitHub Docs retrieved 2026-10-27Expire user access tokens
is enabled by default. If your app's authentication code hasn't been updated to support short-lived tokens, uncheck the box until support is added.
- c11 Official docs high confidence
OAuth app access tokens are long-lived by default, but the app can be configured to use user access tokens that expire after eight hours and can be renewed with a refresh token.
- c12 Official docs high confidence
When an OAuth app uses expiring access tokens, the access token expires after eight hours and the refresh token expires after six months without use.
- c13 Official docs high confidence
Using a refresh token invalidates that refresh token and the old access token.
- c14 Official docs high confidence
If a refresh token expires before use, the user must be sent through the web application flow or device flow again to get a new token pair.
Authorizing OAuth apps - GitHub Docs retrieved 2026-10-27If your refresh token expires before you use it, you must send the user through the web application flow or device flow again to get a new token pair.
- c15 Official docs high confidence
Scopes on a refreshed access token match the previous token's scopes; a scope parameter cannot be supplied during refresh to change access.
Authorizing OAuth apps - GitHub Docs retrieved 2026-10-27The scopes on the new access token will match the scopes of the previous token. You cannot provide a
parameter during token refresh in order to change the access of the resulting token.
- c16 Official docs high confidence
Requesting the offline_access scope yields an expiring access token and a refresh token even if the OAuth app is not configured to use expiring tokens.
Scopes for OAuth apps - GitHub Docs retrieved 2026-10-27offline_access | Requests an expiring access token and a refresh token, even if your OAuth app is not configured to use expiring tokens.
- c17 Official docs high confidence
OAuth tokens use the user's rate limit of 5,000 requests per hour.
- c18 Official docs high confidence
OAuth apps have lower rate limits than GitHub Apps and these do not scale.
- c19 Official docs high confidence
Rate limit increases are granted per OAuth app, and every token granted to that OAuth app gets the increased limit.
- c20 Official docs high confidence
There is a limit of ten tokens issued per user/application/scope combination, with a rate limit of ten tokens created per hour.
Authorizing OAuth apps - GitHub Docs retrieved 2026-10-27There is a limit of ten tokens that are issued per user/application/scope combination, and a rate limit of ten tokens created per hour.
- c21 Official docs high confidence
Exceeding the hourly token-creation rate limit triggers a re-authorization prompt in the browser rather than revoking the oldest token.
Authorizing OAuth apps - GitHub Docs retrieved 2026-10-27Hitting the hourly rate limit will not revoke your oldest token. Instead, it will trigger a re-authorization prompt within the browser
- c22 Official docs high confidence
In the device flow, the device_code and user_code expire after 900 seconds (15 minutes) by default.
- c23 Official docs high confidence
In the device flow, there is a rate limit of 50 verification-code submissions per hour per application.
Authorizing OAuth apps - GitHub Docs retrieved 2026-10-27When a user submits the verification code on the browser, there is a rate limit of 50 submissions in an hour per application.
- c24 Official docs high confidence
In the device flow, polling faster than the interval returns a slow_down error that adds 5 extra seconds to the minimum interval between requests.
Authorizing OAuth apps - GitHub Docs retrieved 2026-10-27When you receive the slow_down error, 5 extra seconds are added to the minimum interval or timeframe required between your requests
- c25 Official docs high confidence
GitHub's OAuth implementation supports the authorization code grant type and the Device Authorization Grant, but not the implicit grant type.
Authorizing OAuth apps - GitHub Docs retrieved 2026-10-27GitHub's OAuth implementation supports the standard
authorization code grant type
and the OAuth 2.0
Device Authorization Grant
for apps that don't have access to a web browser.
- c26 Official docs high confidence
The web application flow is used to authorize users for standard OAuth apps that run in the browser, and the implicit grant type is not supported.
Authorizing OAuth apps - GitHub Docs retrieved 2026-10-27web application flow
: Used to authorize users for standard OAuth apps that run in the browser. (The
implicit grant type
is not supported.)
- c27 Official docs high confidence
The device flow is used for headless apps such as CLI tools.
- c28 Official docs high confidence
Requested scopes are displayed to the user on the authorization form when setting up an OAuth app.
- c29 Official docs high confidence
Scopes limit access for OAuth tokens and do not grant any permission beyond what the user already has.
Scopes for OAuth apps - GitHub Docs retrieved 2026-10-27Scopes
limit
access for OAuth tokens. They do not grant any additional permission beyond that which the user already has.
- c30 Official docs high confidence
Users can edit their scopes and grant an OAuth app less access than requested, and can also edit token scopes after the OAuth flow completes.
Scopes for OAuth apps - GitHub Docs retrieved 2026-10-27However, users can edit their scopes, effectively
granting your application less access than you originally requested. Also, users
can edit token scopes after the OAuth flow is completed.
- c31 Official docs high confidence
OAuth apps cannot use granular permissions; for example, accessing issues, pull requests, or anything owned by the repository requires the repo scope.
- c32 Official docs high confidence
The repo scope grants full access to public and private repositories, including read and write access to code, and also grants access to manage organization-owned resources such as projects, invitations, team memberships and webhooks.
Scopes for OAuth apps - GitHub Docs retrieved 2026-10-27repo | Grants full access to public and private repositories including read and write access to code, commit statuses, repository invitations, collaborators, deployment statuses, and repository webhoo
- c33 Official docs high confidence
The public_repo scope limits access to public repositories, including read/write access to code, commit statuses, repository projects, collaborators, and deployment statuses for public repositories and organizations.
Scopes for OAuth apps - GitHub Docs retrieved 2026-10-27public_repo | Limits access to public repositories. That includes read/write access to code, commit statuses, repository projects, collaborators, and deployment statuses for public repositories and or
- c34 Official docs high confidence
When multiple scopes are requested, the token is saved with a normalized scope list that discards scopes implicitly included by another requested scope.
Scopes for OAuth apps - GitHub Docs retrieved 2026-10-27When requesting multiple scopes, the token is saved with a normalized list
of scopes, discarding those that are implicitly included by another requested
scope.
- c35 Official docs high confidence
If no scope is provided, the scope defaults to an empty list for users who have not authorized any scopes for the application.
- c36 Official docs high confidence
The redirect_uri parameter is strongly recommended and is the URL where users are sent after authorization.
- c37 Official docs high confidence
When an organization enables OAuth app access restrictions, organization members and outside collaborators cannot authorize OAuth app access to organization resources; users can request owner approval and owners are notified of pending requests.
About OAuth app access restrictions - GitHub Docs retrieved 2026-10-27When OAuth app access restrictions are enabled, organization members and outside collaborators cannot authorize OAuth app access to organization resources. Users can request owner approval for OAuth a
- c38 Official docs high confidence
OAuth app access restrictions are enabled by default for newly created organizations.
- c39 Official docs high confidence
If an organization application policy is active, any organization member can request to install an OAuth app on the organization, and an organization owner must approve or deny the request.
- c40 Official docs high confidence
If an organization application policy is active, only an organization owner can authorize the installation of an OAuth app.
- c41 Official docs high confidence
When an organization has not set up OAuth app access restrictions, any OAuth app authorized by an organization member can also access the organization's private resources.
- c42 Official docs high confidence
When OAuth app access restrictions are first enabled, OAuth apps immediately lose access to the organization's resources, while applications owned by the organization are automatically given access.
About OAuth app access restrictions - GitHub Docs retrieved 2026-10-27Applications that are owned by the organization
are automatically given access to the organization's resources.
OAuth apps
immediately lose access to the organization's resources.
- c43 Official docs high confidence
If an organization disables OAuth app access restrictions and later re-enables them, previously approved OAuth apps are automatically granted access to the organization's resources.
About OAuth app access restrictions - GitHub Docs retrieved 2026-10-27If an organization disables OAuth app access application restrictions, and later re-enables them, previously approved OAuth app are automatically granted access to the organization's resources.
- c44 Official docs high confidence
When an organization removes access from a previously approved OAuth app, pre-existing webhooks created by that app are disabled (not deleted) and no longer dispatched.
About OAuth app access restrictions - GitHub Docs retrieved 2026-10-27When an organization removes access from a previously-approved OAuth app, any pre-existing webhooks created by that application will no longer be dispatched (these hooks will be disabled, but not dele
- c45 Official docs high confidence
An OAuth app requires interactive authentication by a user to receive a user access token.
- c46 Official docs high confidence
Authorizing an OAuth app grants the app access to the user's accessible resources, such as repositories they can access.
- c47 Official docs high confidence
An OAuth access token loses access to resources when the user loses access, such as when they lose write access to a repository.
- c48 Official docs high confidence
OAuth apps must configure webhooks individually for each repository and organization, unlike GitHub Apps which have built-in centralized webhooks.
- c49 Official docs high confidence
Webhooks are not automatically disabled if an OAuth app's access token is deleted, and there is no way to clean them up automatically.
- c50 Official docs high confidence
An OAuth app is the preferred choice over a GitHub App when the app needs to access enterprise-level resources such as the enterprise object itself.
- c51 Inferred medium confidence
None of the 9 official pages read mentions an app review, approval or listing-review process. This is absence of evidence in the pages we read, not confirmation that no such requirement exists.
- c52 Inferred medium confidence
None of the 9 official pages read mentions business, identity or publisher verification. This is absence of evidence in the pages we read, not confirmation that no such requirement exists.
- c53 Inferred medium confidence
None of the 9 official pages read mentions a security assessment or audit. This is absence of evidence in the pages we read, not confirmation that no such requirement exists.
- c54 Inferred medium confidence
None of the 9 official pages read mentions partner programs, access requests or sales approval. This is absence of evidence in the pages we read, not confirmation that no such requirement exists.
- c55 Tested high confidence
GET /.well-known/oauth-authorization-server on github.com returned HTTP 404, so no OAuth metadata is published at this path
- c56 Tested high confidence
GET /.well-known/openid-configuration on github.com returned HTTP 404, so no OAuth metadata is published at this path
- c57 Tested high confidence
Calling the authorization endpoint with an unregistered client_id returned HTTP 302, redirecting to github.com/login.
- c58 Tested high confidence
Posting fake client credentials to the token endpoint returned HTTP 404, error code 'Not Found'.
- c59 Tested medium confidence
Opening the developer console URL while signed out returned HTTP 302, redirecting to github.com/login, which looks like a sign-in wall.
Last verified 2026-10-28; recheck after 2027-01-26. Generated by deepseek-chat / pipeline v0.1 · raw JSON