{"verdict":{"headline":"Self-serve and fast for a personal or org-owned OAuth app: the docs we read describe no app review, verification or fee, so registration is a form you can fill in today; the real friction is organization-level OAuth app access restrictions, which are on by default for new orgs and need an owner to approve.","can_start_today":true,"difficulty":{"score":1,"label":"self_serve","factors":{"review_required":"none","business_verification":"no","security_assessment":"no","paid_plan_or_fee_required":"no","partner_or_sales_gated":"no","domain_or_policy_pages_required":"no","user_cap_before_approval":null},"rationale":["Review: none (base score 1)."]},"recommended_path_id":"org_owned_restricted","composio_managed_app_available":"unknown","claim_ids":["c3","c5","c6","c37","c38","c39","c40","c51","c52","c53","c54"],"difficulty_range":{"easiest":1,"hardest":1},"overall_confidence":"high"},"effort":{"hands_on":{"min":10,"max":30,"unit":"minutes","basis":"Estimate: one registration form (name, homepage URL, callback URL, optional description) plus optional device-flow checkbox and token-expiry setting; no review or verification steps to prepare.","claim_ids":["c5","c6","c9","c10"]},"approval_wait":{"min":0.0,"max":0.0,"unit":"minutes","partial":true,"basis":"Across routes, from the easiest to the hardest published figure. At least one route publishes no figure or only part of one, so treat this as a lower bound.","claim_ids":["c51"]},"ongoing_maintenance":"Keep the callback URL list current (up to 10), decide whether to keep expiring user tokens enabled, and re-authorize users if a refresh token expires unused. If an organization enables OAuth app access restrictions, previously working apps lose org access until an owner approves them.","total_calendar_estimate":{"min":10,"max":30,"unit":"minutes","basis":"Estimate: registration is self-serve with no documented review; the only variable wait is an organization owner approving access, which has no published timeframe.","claim_ids":["c7","c10","c14","c42","c51"]}},"paths":[{"id":"personal_owned","name":"OAuth app under a personal account","who_its_for":"A developer building an agent or tool for their own users, where the app is owned by an individual account and does not need organization-owned resources.","effort":{"hands_on":{"min":10,"max":20,"unit":"minutes","basis":"Estimate: one settings form with three required fields, plus optional device-flow and token-expiry toggles.","claim_ids":["c5","c6","c9","c10"]},"approval_wait":{"min":0,"max":0,"unit":"minutes","basis":"No review step found in the documentation read (inferred)","claim_ids":["c51"]}},"requirements":[{"text":"A GitHub account to own the app.","kind":"account","blocking":true,"claim_ids":["c3"]},{"text":"An application name, a full homepage URL and an authorization callback URL (description optional).","kind":"technical","blocking":true,"claim_ids":["c6"]},{"text":"Only public-safe information in the app registration; avoid internal URLs and sensitive data.","kind":"other","blocking":false,"claim_ids":["c8"]}],"limits":["Up to 100 OAuth apps per user or organization.","Up to 10 callback URLs per app.","OAuth tokens use the user's rate limit of 5,000 requests per hour, and OAuth app rate limits are lower than GitHub Apps' and do not scale.","Ten tokens per user/application/scope combination, with ten token creations per hour."],"factors":{"review_required":"none","business_verification":"no","security_assessment":"no","paid_plan_or_fee_required":"no","partner_or_sales_gated":"no","domain_or_policy_pages_required":"no","user_cap_before_approval":null},"claim_ids":["c3","c4","c5","c6","c7","c8","c17","c18","c20","c51","c52","c53","c54"],"difficulty":{"score":1,"label":"self_serve","rationale":["Review: none (base score 1)."]},"step_ids":["s1","s2","s3","s4","s5","s7"]},{"id":"org_owned_restricted","name":"OAuth app owned by an organization, or used against org resources with access restrictions","who_its_for":"A developer whose app is owned by an organization, or whose users need access to organization-owned private resources where the org has OAuth app access restrictions or an application policy in place.","effort":{"hands_on":{"min":15,"max":45,"unit":"minutes","basis":"Estimate: the same registration form, plus coordinating with an organization owner and, where a policy is active, having the owner approve the request.","claim_ids":["c5","c6","c37","c39","c40"]},"approval_wait":{"min":null,"max":null,"unit":"unknown","basis":"An organization owner must approve access or the install request, but the docs read give no timeframe for that decision.","claim_ids":["c37","c39","c40"]}},"requirements":[{"text":"Administrative access to the organization the app is registered under.","kind":"account","blocking":true,"claim_ids":["c3"]},{"text":"An application name, a full homepage URL and an authorization callback URL (description optional).","kind":"technical","blocking":true,"claim_ids":["c6"]},{"text":"Organization owner approval when OAuth app access restrictions are enabled, or when an organization application policy is active.","kind":"other","blocking":true,"claim_ids":["c37","c39","c40"]}],"limits":["Up to 100 OAuth apps per user or organization.","Up to 10 callback URLs per app.","With access restrictions enabled, members and outside collaborators cannot authorize OAuth app access to org resources until an owner approves.","When restrictions are first enabled, existing OAuth apps immediately lose org access; org-owned apps are automatically granted access.","If an org removes access from a previously approved app, that app's pre-existing webhooks are disabled and no longer dispatched.","OAuth tokens use the user's rate limit of 5,000 requests per hour, and OAuth app rate limits are lower than GitHub Apps' and do not scale."],"factors":{"review_required":"none","business_verification":"no","security_assessment":"no","paid_plan_or_fee_required":"no","partner_or_sales_gated":"no","domain_or_policy_pages_required":"no","user_cap_before_approval":null},"claim_ids":["c3","c4","c6","c7","c17","c18","c37","c38","c39","c40","c41","c42","c43","c44","c51","c52","c53","c54"],"difficulty":{"score":1,"label":"self_serve","rationale":["Review: none (base score 1)."]},"step_ids":["s1","s2","s3","s4","s5","s6","s7"]}],"conflicts":[],"open_questions":[{"question":"Does GitHub require any app review, listing review, business/identity verification, security assessment or fee for an OAuth app used by the public? The pages read describe none, but that is absence of evidence, not confirmation.","how_to_resolve":"Check GitHub's current OAuth app and Marketplace/listing documentation, or contact GitHub support, before promising users a launch date."},{"question":"How long does an organization owner take to approve an OAuth app access request or install request?","how_to_resolve":"Ask the target organization's owners; the docs give no timeframe."},{"question":"Should the app be a GitHub App instead of an OAuth app? GitHub's docs recommend GitHub Apps for fine-grained permissions and short-lived tokens, but an OAuth app is preferred when enterprise-level resources are needed.","how_to_resolve":"Decide based on whether the agent needs enterprise-level resources or only repository-scoped access."},{"question":"Is a managed OAuth app available so the developer can skip registration entirely?","how_to_resolve":"Check the platform's managed-auth offering; the claims here do not cover it."},{"question":"Do the console steps match what the developer console actually shows today?","how_to_resolve":"This guide came from documentation and unauthenticated endpoint checks. Nobody signed in or created an app, so click-by-click steps are documented, not observed."}],"steps":[{"id":"s1","order":1,"title":"Sign in to GitHub and open Developer settings","actor":"human","human_required_because":"login_or_mfa","instructions":["Sign in to the GitHub account that will own the app (personal account, or an org you administer).","Go to profile picture > Settings > Developer settings > OAuth apps."],"url":"https://github.com/settings/developers","expected_result":"You see the OAuth apps list with a New OAuth App button (Register a new application on first use).","estimated_minutes":2,"agent_status":"not_attempted","claim_ids":["c5","c59"],"applies_to":[]},{"id":"s2","order":2,"title":"Decide app type and owner","actor":"human","human_required_because":"developer_decision","instructions":["GitHub's docs recommend a GitHub App over an OAuth app for fine-grained permissions and short-lived tokens; pick OAuth app only if you need it (for example enterprise-level resources).","Choose the owning account: personal account, or an organization you administer. Each owner can hold up to 100 OAuth apps."],"expected_result":"You know which account will own the app and why you chose OAuth app.","estimated_minutes":5,"agent_status":"not_attempted","claim_ids":["c1","c3","c4","c50"],"applies_to":[]},{"id":"s3","order":3,"title":"Fill in the registration form","actor":"agent","instructions":["Provide an application name, a full homepage URL and an authorization callback URL. Description is optional.","Keep everything public-safe: no internal URLs or sensitive data.","Add up to 10 callback URLs if you need more than one.","Check Enable Device Flow if your agent uses the device flow."],"expected_result":"Form is complete and ready to submit.","copy_paste":[{"label":"Authorization callback URL","value":"https://YOUR-APP.example/oauth/callback"}],"estimated_minutes":10,"agent_status":"not_attempted","claim_ids":["c6","c7","c8","c9"],"human_required_because":"none","applies_to":[]},{"id":"s4","order":4,"title":"Submit registration and copy credentials","actor":"human","human_required_because":"legal_acceptance","instructions":["Click Register application.","Copy the client ID and generate a client secret; store them outside the repo."],"expected_result":"App appears in the OAuth apps list with a client ID and secret.","estimated_minutes":3,"agent_status":"not_attempted","claim_ids":["c5","c6"],"applies_to":[]},{"id":"s5","order":5,"title":"Choose token expiry setting","actor":"human","human_required_because":"developer_decision","instructions":["Expire user access tokens is on by default. Leave it on if your client supports refresh tokens (8-hour access token, refresh token valid 6 months unused).","Uncheck it only if your auth code cannot handle short-lived tokens yet."],"expected_result":"Token expiry setting matches what your client can handle.","estimated_minutes":5,"agent_status":"not_attempted","claim_ids":["c10","c11","c12"],"applies_to":[]},{"id":"s6","order":6,"title":"Get organization approval for the app","actor":"human","human_required_because":"third_party_action","instructions":["If the org has OAuth app access restrictions, members and outside collaborators cannot authorize the app against org resources; a member requests owner approval and owners are notified.","If an organization application policy is active, only an org owner can authorize the installation; a member can request it and an owner approves or denies.","Note restrictions are on by default for newly created organizations."],"applies_to":["org_owned_restricted"],"expected_result":"An org owner has approved the app, or the org has no restrictions in place.","estimated_minutes":null,"agent_status":"not_attempted","claim_ids":["c37","c38","c39","c40"]},{"id":"s7","order":7,"title":"Have a user authorize the app","actor":"human","human_required_because":"login_or_mfa","instructions":["A user must interactively authorize the app to get a user access token; requested scopes are shown on the authorization form.","Users can grant fewer scopes than requested."],"expected_result":"User access token issued with the granted scopes.","estimated_minutes":3,"agent_status":"not_attempted","claim_ids":["c28","c30","c45","c46"],"applies_to":[]}],"blockers":[{"id":"b1","symptom":"Org members can authorize the app but it cannot see the organization's private repositories.","likely_cause":"The organization has OAuth app access restrictions enabled (default for new orgs), so members and outside collaborators cannot authorize access to org resources.","fix":"Have a member request owner approval; owners are notified of pending requests. Only an org owner can authorize when an application policy is active.","escalation":"Organization owner","claim_ids":["c37","c38","c40"]},{"id":"b2","symptom":"App worked against org resources, then suddenly lost access.","likely_cause":"OAuth app access restrictions were enabled for the organization; apps immediately lose access, except org-owned apps which are auto-granted.","fix":"Request owner approval again, or have the org own the app.","escalation":"Organization owner","claim_ids":["c42"]},{"id":"b3","symptom":"Webhooks created by the app stop firing after the org removed app access.","likely_cause":"Removing access disables (does not delete) pre-existing webhooks created by the app.","fix":"Re-approve the app or recreate the webhooks; webhooks are not cleaned up automatically when a token is deleted.","escalation":null,"claim_ids":["c44","c49"]},{"id":"b4","symptom":"Browser shows a re-authorization prompt instead of the app getting a new token.","likely_cause":"Hit the limit of ten tokens per user/app/scope combination or the ten-tokens-per-hour creation rate.","fix":"Reuse stored tokens instead of requesting new ones; complete the re-authorization prompt.","escalation":null,"claim_ids":["c20","c21"]},{"id":"b5","symptom":"Device flow returns slow_down or the user code stops working.","likely_cause":"Polling faster than the interval, or the device_code/user_code expired (900 seconds by default).","fix":"Respect the interval (slow_down adds 5 seconds) and restart the device flow when codes expire.","escalation":null,"claim_ids":["c22","c24"]},{"id":"b6","symptom":"Requests start failing with rate-limit errors under load.","likely_cause":"OAuth tokens use the user's 5,000 requests/hour limit; OAuth app limits are lower than GitHub Apps' and do not scale.","fix":"Request a rate limit increase for the OAuth app (applies to every token it issues) or reduce request volume.","escalation":"GitHub support","claim_ids":["c17","c18","c19"]},{"id":"b7","symptom":"Developer settings URL redirects to the login page.","likely_cause":"You are signed out; the developer console is behind a sign-in wall.","fix":"Sign in to GitHub first.","escalation":null,"claim_ids":["c59"]}],"gotchas":[{"text":"GitHub's docs recommend a GitHub App over an OAuth app: fine-grained permissions, more control over repository access, short-lived tokens. OAuth apps cannot use granular permissions — repo-level work needs the broad repo scope.","claim_ids":["c1","c31"]},{"text":"The repo scope grants full read/write access to public and private repos plus org-owned resources like projects, invitations, team memberships and webhooks. public_repo is the narrower public-only option.","claim_ids":["c32","c33"]},{"text":"Only the authorization code grant and device flow are supported; the implicit grant is not.","claim_ids":["c25","c26"]},{"text":"Expire user access tokens is on by default. With it on, access tokens last 8 hours and refresh tokens expire after 6 months unused; using a refresh token invalidates the old pair.","claim_ids":["c10","c12","c13"]},{"text":"Requesting offline_access returns an expiring token plus refresh token even if the app is not configured for expiring tokens.","claim_ids":["c16"]},{"text":"A refresh cannot change scopes; the new token keeps the previous scopes. If the refresh token expired, the user must go through the web or device flow again.","claim_ids":["c14","c15"]},{"text":"Users can grant fewer scopes than requested and can edit token scopes afterwards, so handle partial grants.","claim_ids":["c30"]},{"text":"Token is saved with a normalized scope list that drops scopes implied by another requested scope; no scope means an empty list for first-time users.","claim_ids":["c34","c35"]},{"text":"Webhooks must be configured per repository and organization, and are not disabled automatically when a token is deleted.","claim_ids":["c48","c49"]},{"text":"An OAuth app is the better choice when you need enterprise-level resources such as the enterprise object.","claim_ids":["c50"]},{"text":"The docs we read describe no app review, business verification, security assessment or partner/sales gate for OAuth apps; that is absence of evidence, not confirmation.","claim_ids":["c51","c52","c53","c54"]},{"text":"No OAuth metadata is published at /.well-known/oauth-authorization-server or /.well-known/openid-configuration on github.com; configure endpoints manually.","claim_ids":["c55","c56"]}],"oauth_config":{"grant_types":["authorization_code","urn:ietf:params:oauth:grant-type:device_code"],"pkce":"unknown","client_auth_methods":["client_secret"],"redirect_uri_rules":["Authorization callback URL is required at registration","Up to 10 callback URLs per app","redirect_uri is strongly recommended on the authorization request"],"token_lifetimes":{"access":"8 hours when expiring tokens are enabled; long-lived by default otherwise","refresh":"6 months without use","notes":"Using a refresh token invalidates the old refresh token and access token; refresh cannot change scopes."},"app_types":["OAuth App (GitHub recommends GitHub App instead for fine-grained permissions)"],"scopes":[{"name":"repo","purpose":"Full read/write access to public and private repos plus org-owned resources","sensitivity":"sensitive","triggers_review":"unknown"},{"name":"public_repo","purpose":"Read/write access limited to public repositories","sensitivity":"basic","triggers_review":"unknown"},{"name":"offline_access","purpose":"Returns an expiring access token plus a refresh token","sensitivity":"basic","triggers_review":"unknown"}],"claim_ids":["c11","c12","c13","c15","c16","c25","c31","c32","c33","c36","c55","c56","c57","c58","c6","c7","c9"],"authorization_url":"https://github.com/login/oauth/authorize","token_url":"https://github.com/login/oauth/access_token"},"review_process":null,"meta":{"slug":"github","app_name":"GitHub","provider_url":"https://github.com","developer_console_url":"https://github.com/settings/developers","origin":"live_generated","generated_at":"2026-10-27T18:57:06Z","schema_version":"0.1","generator":"deepseek-chat / pipeline v0.1"},"claims":[{"id":"c1","text":"GitHub's official docs recommend building a GitHub App instead of an OAuth app, because GitHub Apps use fine-grained permissions, give users more control over repository access, and use short-lived tokens.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app","title":"Creating an OAuth app - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"Consider building a GitHub App instead of an OAuth app. ... GitHub Apps use fine-grained permissions, give the user more control over which repositories the app can access, and use short-lived tokens."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"app_types"},{"id":"c2","text":"GitHub states that GitHub Apps are generally preferred over OAuth apps because they use fine-grained permissions, give more control over which repositories the app can access, and use short-lived tokens.","evidence_level":"unverified","confidence":"low","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps","title":"Differences between GitHub Apps and OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":""}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"app_types"},{"id":"c3","text":"An OAuth app can be created and registered under a personal account or under any organization the developer has administrative access to.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app","title":"Creating an OAuth app - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"You can create and register an OAuth app under your personal account or under any organization you have administrative access to."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"app_creation"},{"id":"c4","text":"A user or organization can own up to 100 OAuth apps.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app","title":"Creating an OAuth app - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"A user or organization can own up to 100 OAuth apps."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"fees_or_limits"},{"id":"c5","text":"An OAuth app is registered through the profile picture > Settings > Developer settings > OAuth apps, then clicking New OAuth App (labeled Register a new application for first-time users).","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app","title":"Creating an OAuth app - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"In the left sidebar, click \n Developer settings\n.\nIn the left sidebar, click \nOAuth apps\n.\nClick \nNew OAuth App\n."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"app_creation"},{"id":"c6","text":"Registering an OAuth app requires an application name, a full homepage URL, and an authorization callback URL; the description is optional.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app","title":"Creating an OAuth app - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"In \"Homepage URL\", type the full URL to your app's website.\nOptionally, in \"Application description\", type a description of your app that users will see.\nIn \"Authorization callback URL\", type the call"}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"app_creation"},{"id":"c7","text":"An OAuth app can have up to 10 callback URLs, added via Add callback URL.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app","title":"Creating an OAuth app - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"You can enter up to 10 callback URLs. To add additional callback URLs, click \nAdd callback URL\n."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"redirect_uris"},{"id":"c8","text":"GitHub warns that only information considered public should be used in an OAuth app, avoiding sensitive data such as internal URLs.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app","title":"Creating an OAuth app - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"Only use information in your OAuth app that you consider public. Avoid using sensitive data, such as internal URLs, when creating an OAuth app."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"requirements"},{"id":"c9","text":"For OAuth apps using the device flow, the Enable Device Flow option must be checked when registering the app.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app","title":"Creating an OAuth app - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"If your OAuth app will use the device flow to identify and authorize users, click \nEnable Device Flow\n."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"app_creation"},{"id":"c10","text":"Expire user access tokens is enabled by default for OAuth apps; apps whose authentication code does not yet support short-lived tokens should uncheck it until support is added.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app","title":"Creating an OAuth app - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"Expire user access tokens\n is enabled by default. If your app's authentication code hasn't been updated to support short-lived tokens, uncheck the box until support is added."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"tokens"},{"id":"c11","text":"OAuth app access tokens are long-lived by default, but the app can be configured to use user access tokens that expire after eight hours and can be renewed with a refresh token.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps","title":"Differences between GitHub Apps and OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"OAuth app tokens re long-lived by default. You can also configure your OAuth app to use user access tokens that expire after eight hours and can be renewed with a refresh token."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"tokens"},{"id":"c12","text":"When an OAuth app uses expiring access tokens, the access token expires after eight hours and the refresh token expires after six months without use.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps","title":"Authorizing OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"The access token expires after eight hours, and the refresh token expires after six months without use."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"tokens"},{"id":"c13","text":"Using a refresh token invalidates that refresh token and the old access token.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps","title":"Authorizing OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"Once you use a refresh token, that refresh token and the old access token will no longer work."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"tokens"},{"id":"c14","text":"If a refresh token expires before use, the user must be sent through the web application flow or device flow again to get a new token pair.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps","title":"Authorizing OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"If your refresh token expires before you use it, you must send the user through the web application flow or device flow again to get a new token pair."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"tokens"},{"id":"c15","text":"Scopes on a refreshed access token match the previous token's scopes; a scope parameter cannot be supplied during refresh to change access.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps","title":"Authorizing OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"The scopes on the new access token will match the scopes of the previous token. You cannot provide a \n parameter during token refresh in order to change the access of the resulting token."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"scopes"},{"id":"c16","text":"Requesting the offline_access scope yields an expiring access token and a refresh token even if the OAuth app is not configured to use expiring tokens.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps","title":"Scopes for OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"offline_access | Requests an expiring access token and a refresh token, even if your OAuth app is not configured to use expiring tokens."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"scopes"},{"id":"c17","text":"OAuth tokens use the user's rate limit of 5,000 requests per hour.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps","title":"Differences between GitHub Apps and OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"OAuth tokens use the user's rate limit of 5,000 requests per hour."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"fees_or_limits"},{"id":"c18","text":"OAuth apps have lower rate limits than GitHub Apps and these do not scale.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps","title":"Differences between GitHub Apps and OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"Conversely, OAuth apps have lower rate limits and do not scale."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"fees_or_limits"},{"id":"c19","text":"Rate limit increases are granted per OAuth app, and every token granted to that OAuth app gets the increased limit.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps","title":"Differences between GitHub Apps and OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"Rate limit increases are granted per OAuth app. Every token granted to that OAuth app gets the increased limit."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"fees_or_limits"},{"id":"c20","text":"There is a limit of ten tokens issued per user/application/scope combination, with a rate limit of ten tokens created per hour.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps","title":"Authorizing OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"There is a limit of ten tokens that are issued per user/application/scope combination, and a rate limit of ten tokens created per hour."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"fees_or_limits"},{"id":"c21","text":"Exceeding the hourly token-creation rate limit triggers a re-authorization prompt in the browser rather than revoking the oldest token.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps","title":"Authorizing OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"Hitting the hourly rate limit will not revoke your oldest token. Instead, it will trigger a re-authorization prompt within the browser"}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"fees_or_limits"},{"id":"c22","text":"In the device flow, the device_code and user_code expire after 900 seconds (15 minutes) by default.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps","title":"Authorizing OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"The number of seconds before the device_code and user_code expire. The default is 900 seconds or 15 minutes."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"tokens"},{"id":"c23","text":"In the device flow, there is a rate limit of 50 verification-code submissions per hour per application.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps","title":"Authorizing OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"When a user submits the verification code on the browser, there is a rate limit of 50 submissions in an hour per application."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"fees_or_limits"},{"id":"c24","text":"In the device flow, polling faster than the interval returns a slow_down error that adds 5 extra seconds to the minimum interval between requests.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps","title":"Authorizing OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"When you receive the slow_down error, 5 extra seconds are added to the minimum interval or timeframe required between your requests"}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"fees_or_limits"},{"id":"c25","text":"GitHub's OAuth implementation supports the authorization code grant type and the Device Authorization Grant, but not the implicit grant type.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps","title":"Authorizing OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"GitHub's OAuth implementation supports the standard \nauthorization code grant type\n and the OAuth 2.0 \nDevice Authorization Grant\n for apps that don't have access to a web browser."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"app_types"},{"id":"c26","text":"The web application flow is used to authorize users for standard OAuth apps that run in the browser, and the implicit grant type is not supported.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps","title":"Authorizing OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"web application flow\n: Used to authorize users for standard OAuth apps that run in the browser. (The \nimplicit grant type\n is not supported.)"}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"app_types"},{"id":"c27","text":"The device flow is used for headless apps such as CLI tools.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps","title":"Authorizing OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"device flow\n: Used for headless apps, such as CLI tools."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"app_types"},{"id":"c28","text":"Requested scopes are displayed to the user on the authorization form when setting up an OAuth app.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps","title":"Scopes for OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"When setting up an OAuth app on GitHub, requested scopes are displayed to the user on the authorization form."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"scopes"},{"id":"c29","text":"Scopes limit access for OAuth tokens and do not grant any permission beyond what the user already has.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps","title":"Scopes for OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"Scopes \nlimit\n access for OAuth tokens. They do not grant any additional permission beyond that which the user already has."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"scopes"},{"id":"c30","text":"Users can edit their scopes and grant an OAuth app less access than requested, and can also edit token scopes after the OAuth flow completes.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps","title":"Scopes for OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"However, users can edit their scopes, effectively\ngranting your application less access than you originally requested. Also, users\ncan edit token scopes after the OAuth flow is completed."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"scopes"},{"id":"c31","text":"OAuth apps cannot use granular permissions; for example, accessing issues, pull requests, or anything owned by the repository requires the repo scope.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps","title":"Differences between GitHub Apps and OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"OAuth apps need to request the repo scope to get access to issues, pull requests, or anything owned by the repository."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"scopes"},{"id":"c32","text":"The repo scope grants full access to public and private repositories, including read and write access to code, and also grants access to manage organization-owned resources such as projects, invitations, team memberships and webhooks.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps","title":"Scopes for OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"repo | Grants full access to public and private repositories including read and write access to code, commit statuses, repository invitations, collaborators, deployment statuses, and repository webhoo"}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"scopes"},{"id":"c33","text":"The public_repo scope limits access to public repositories, including read/write access to code, commit statuses, repository projects, collaborators, and deployment statuses for public repositories and organizations.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps","title":"Scopes for OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"public_repo | Limits access to public repositories. That includes read/write access to code, commit statuses, repository projects, collaborators, and deployment statuses for public repositories and or"}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"scopes"},{"id":"c34","text":"When multiple scopes are requested, the token is saved with a normalized scope list that discards scopes implicitly included by another requested scope.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps","title":"Scopes for OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"When requesting multiple scopes, the token is saved with a normalized list\nof scopes, discarding those that are implicitly included by another requested\nscope."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"scopes"},{"id":"c35","text":"If no scope is provided, the scope defaults to an empty list for users who have not authorized any scopes for the application.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps","title":"Authorizing OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"If not provided, scope defaults to an empty list for users that have not authorized any scopes for the application."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"scopes"},{"id":"c36","text":"The redirect_uri parameter is strongly recommended and is the URL where users are sent after authorization.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps","title":"Authorizing OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"redirect_uri | string | Strongly recommended | The URL in your application where users will be sent after authorization."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"redirect_uris"},{"id":"c37","text":"When an organization enables OAuth app access restrictions, organization members and outside collaborators cannot authorize OAuth app access to organization resources; users can request owner approval and owners are notified of pending requests.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/about-oauth-app-access-restrictions","title":"About OAuth app access restrictions - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"When OAuth app access restrictions are enabled, organization members and outside collaborators cannot authorize OAuth app access to organization resources. Users can request owner approval for OAuth a"}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"review_or_verification"},{"id":"c38","text":"OAuth app access restrictions are enabled by default for newly created organizations.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/about-oauth-app-access-restrictions","title":"About OAuth app access restrictions - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"When you create a new organization, OAuth app access restrictions are enabled by default."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"review_or_verification"},{"id":"c39","text":"If an organization application policy is active, any organization member can request to install an OAuth app on the organization, and an organization owner must approve or deny the request.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps","title":"Differences between GitHub Apps and OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"If an organization application policy is active, any organization member can request to install an OAuth app on an organization. An organization owner must approve or deny the request."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"review_or_verification"},{"id":"c40","text":"If an organization application policy is active, only an organization owner can authorize the installation of an OAuth app.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps","title":"Differences between GitHub Apps and OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"If an organization application policy is active, only an organization owner can authorize the installation of an OAuth app."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"review_or_verification"},{"id":"c41","text":"When an organization has not set up OAuth app access restrictions, any OAuth app authorized by an organization member can also access the organization's private resources.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/about-oauth-app-access-restrictions","title":"About OAuth app access restrictions - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"When an organization has not set up OAuth app access restrictions, any OAuth app authorized by an organization member can also access the organization's private resources."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"review_or_verification"},{"id":"c42","text":"When OAuth app access restrictions are first enabled, OAuth apps immediately lose access to the organization's resources, while applications owned by the organization are automatically given access.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/about-oauth-app-access-restrictions","title":"About OAuth app access restrictions - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"Applications that are owned by the organization\n are automatically given access to the organization's resources.\nOAuth apps\n immediately lose access to the organization's resources."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"review_or_verification"},{"id":"c43","text":"If an organization disables OAuth app access restrictions and later re-enables them, previously approved OAuth apps are automatically granted access to the organization's resources.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/about-oauth-app-access-restrictions","title":"About OAuth app access restrictions - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"If an organization disables OAuth app access application restrictions, and later re-enables them, previously approved OAuth app are automatically granted access to the organization's resources."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"review_or_verification"},{"id":"c44","text":"When an organization removes access from a previously approved OAuth app, pre-existing webhooks created by that app are disabled (not deleted) and no longer dispatched.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/about-oauth-app-access-restrictions","title":"About OAuth app access restrictions - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"When an organization removes access from a previously-approved OAuth app, any pre-existing webhooks created by that application will no longer be dispatched (these hooks will be disabled, but not dele"}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"review_or_verification"},{"id":"c45","text":"An OAuth app requires interactive authentication by a user to receive a user access token.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps","title":"Differences between GitHub Apps and OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"An OAuth app requires interactive authentication by a user to receive a user access token."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"tokens"},{"id":"c46","text":"Authorizing an OAuth app grants the app access to the user's accessible resources, such as repositories they can access.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps","title":"Differences between GitHub Apps and OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"Authorizing an OAuth app grants the app access to the user's accessible resources. For example, repositories they can access."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"scopes"},{"id":"c47","text":"An OAuth access token loses access to resources when the user loses access, such as when they lose write access to a repository.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps","title":"Differences between GitHub Apps and OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"An OAuth access token loses access to resources when the user loses access, such as when they lose write access to a repository."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"tokens"},{"id":"c48","text":"OAuth apps must configure webhooks individually for each repository and organization, unlike GitHub Apps which have built-in centralized webhooks.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps","title":"Differences between GitHub Apps and OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"Conversely, OAuth apps must configure webhooks individually for each repository and organization."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"requirements"},{"id":"c49","text":"Webhooks are not automatically disabled if an OAuth app's access token is deleted, and there is no way to clean them up automatically.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps","title":"Differences between GitHub Apps and OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"Webhooks are not automatically disabled if an OAuth app's access token is deleted, and there is no way to clean them up automatically."}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"requirements"},{"id":"c50","text":"An OAuth app is the preferred choice over a GitHub App when the app needs to access enterprise-level resources such as the enterprise object itself.","evidence_level":"official_docs","confidence":"high","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps","title":"Differences between GitHub Apps and OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":"There is one case where an OAuth app is preferred over a GitHub App. If your app needs to access enterprise-level resources such as the enterprise object itself, you should use an OAuth app"}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"app_types"},{"id":"c51","text":"None of the 9 official pages read mentions an app review, approval or listing-review process. This is absence of evidence in the pages we read, not confirmation that no such requirement exists.","evidence_level":"inferred","confidence":"medium","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app","title":"Creating an OAuth app - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":""},{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps","title":"Authorizing OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":""},{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps","title":"Scopes for OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":""},{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps","title":"Differences between GitHub Apps and OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":""},{"url":"https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/about-oauth-app-access-restrictions","title":"About OAuth app access restrictions - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":""},{"url":"https://github.com/resources/articles/what-is-an-api","title":"What is an API? · GitHub","retrieved_at":"2026-10-27T18:56:08Z","excerpt":""},{"url":"https://docs.github.com/en/apps/oauth-apps","title":"OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:09Z","excerpt":""},{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps","title":"Building OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:09Z","excerpt":""},{"url":"https://docs.github.com/en/apps/using-github-apps/authorizing-github-apps","title":"Authorizing GitHub Apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:09Z","excerpt":""}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"absence"},{"id":"c52","text":"None of the 9 official pages read mentions business, identity or publisher verification. This is absence of evidence in the pages we read, not confirmation that no such requirement exists.","evidence_level":"inferred","confidence":"medium","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app","title":"Creating an OAuth app - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":""},{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps","title":"Authorizing OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":""},{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps","title":"Scopes for OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":""},{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps","title":"Differences between GitHub Apps and OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":""},{"url":"https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/about-oauth-app-access-restrictions","title":"About OAuth app access restrictions - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":""},{"url":"https://github.com/resources/articles/what-is-an-api","title":"What is an API? · GitHub","retrieved_at":"2026-10-27T18:56:08Z","excerpt":""},{"url":"https://docs.github.com/en/apps/oauth-apps","title":"OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:09Z","excerpt":""},{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps","title":"Building OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:09Z","excerpt":""},{"url":"https://docs.github.com/en/apps/using-github-apps/authorizing-github-apps","title":"Authorizing GitHub Apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:09Z","excerpt":""}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"absence"},{"id":"c53","text":"None of the 9 official pages read mentions a security assessment or audit. This is absence of evidence in the pages we read, not confirmation that no such requirement exists.","evidence_level":"inferred","confidence":"medium","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app","title":"Creating an OAuth app - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":""},{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps","title":"Authorizing OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":""},{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps","title":"Scopes for OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":""},{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps","title":"Differences between GitHub Apps and OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":""},{"url":"https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/about-oauth-app-access-restrictions","title":"About OAuth app access restrictions - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":""},{"url":"https://github.com/resources/articles/what-is-an-api","title":"What is an API? · GitHub","retrieved_at":"2026-10-27T18:56:08Z","excerpt":""},{"url":"https://docs.github.com/en/apps/oauth-apps","title":"OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:09Z","excerpt":""},{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps","title":"Building OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:09Z","excerpt":""},{"url":"https://docs.github.com/en/apps/using-github-apps/authorizing-github-apps","title":"Authorizing GitHub Apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:09Z","excerpt":""}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"absence"},{"id":"c54","text":"None of the 9 official pages read mentions partner programs, access requests or sales approval. This is absence of evidence in the pages we read, not confirmation that no such requirement exists.","evidence_level":"inferred","confidence":"medium","sources":[{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app","title":"Creating an OAuth app - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":""},{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps","title":"Authorizing OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":""},{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps","title":"Scopes for OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":""},{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps","title":"Differences between GitHub Apps and OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":""},{"url":"https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/about-oauth-app-access-restrictions","title":"About OAuth app access restrictions - GitHub Docs","retrieved_at":"2026-10-27T18:56:07Z","excerpt":""},{"url":"https://github.com/resources/articles/what-is-an-api","title":"What is an API? · GitHub","retrieved_at":"2026-10-27T18:56:08Z","excerpt":""},{"url":"https://docs.github.com/en/apps/oauth-apps","title":"OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:09Z","excerpt":""},{"url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps","title":"Building OAuth apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:09Z","excerpt":""},{"url":"https://docs.github.com/en/apps/using-github-apps/authorizing-github-apps","title":"Authorizing GitHub Apps - GitHub Docs","retrieved_at":"2026-10-27T18:56:09Z","excerpt":""}],"test_ref":null,"conflicts_with":[],"corrected_from":null,"topic":"absence"},{"id":"c55","text":"GET /.well-known/oauth-authorization-server on github.com returned HTTP 404, so no OAuth metadata is published at this path","evidence_level":"tested","confidence":"high","sources":[{"url":"https://github.com/.well-known/oauth-authorization-server","title":"Direct request by the agent","retrieved_at":"2026-10-27T18:56:24Z","excerpt":""}],"test_ref":"a21","conflicts_with":[],"corrected_from":null,"topic":"tokens"},{"id":"c56","text":"GET /.well-known/openid-configuration on github.com returned HTTP 404, so no OAuth metadata is published at this path","evidence_level":"tested","confidence":"high","sources":[{"url":"https://github.com/.well-known/openid-configuration","title":"Direct request by the agent","retrieved_at":"2026-10-27T18:56:24Z","excerpt":""}],"test_ref":"a22","conflicts_with":[],"corrected_from":null,"topic":"tokens"},{"id":"c57","text":"Calling the authorization endpoint with an unregistered client_id returned HTTP 302, redirecting to github.com/login.","evidence_level":"tested","confidence":"high","sources":[{"url":"https://github.com/login/oauth/authorize","title":"Direct request by the agent","retrieved_at":"2026-10-27T18:56:24Z","excerpt":""}],"test_ref":"a23","conflicts_with":[],"corrected_from":null,"topic":"redirect_uris"},{"id":"c58","text":"Posting fake client credentials to the token endpoint returned HTTP 404, error code 'Not Found'.","evidence_level":"tested","confidence":"high","sources":[{"url":"https://github.com/login/oauth/access_token","title":"Direct request by the agent","retrieved_at":"2026-10-27T18:56:24Z","excerpt":""}],"test_ref":"a24","conflicts_with":[],"corrected_from":null,"topic":"tokens"},{"id":"c59","text":"Opening the developer console URL while signed out returned HTTP 302, redirecting to github.com/login, which looks like a sign-in wall.","evidence_level":"tested","confidence":"medium","sources":[{"url":"https://github.com/settings/developers","title":"Direct request by the agent","retrieved_at":"2026-10-27T18:56:24Z","excerpt":""}],"test_ref":"a25","conflicts_with":[],"corrected_from":null,"topic":"app_creation"}],"agent_attempt":{"depth":"endpoint_probes","actions":[{"id":"a1","kind":"search","summary":"Searched: site:github.com OAuth 2.0 authentication create application","target":"duckduckgo","outcome":"success","observed":"6 results","screenshot":null,"timestamp":"2026-10-27T18:56:05Z"},{"id":"a2","kind":"search","summary":"Searched: site:github.com developers API OAuth scopes","target":"duckduckgo","outcome":"success","observed":"6 results","screenshot":null,"timestamp":"2026-10-27T18:56:05Z"},{"id":"a3","kind":"search","summary":"Searched: site:github.com app review marketplace listing certification requirements","target":"duckduckgo","outcome":"success","observed":"6 results","screenshot":null,"timestamp":"2026-10-27T18:56:05Z"},{"id":"a4","kind":"search","summary":"Searched: site:github.com API pricing access tiers rate limits","target":"duckduckgo","outcome":"success","observed":"6 results","screenshot":null,"timestamp":"2026-10-27T18:56:06Z"},{"id":"a5","kind":"search","summary":"Searched: GitHub github.com OAuth app review approval verification requirements","target":"duckduckgo","outcome":"success","observed":"6 results","screenshot":null,"timestamp":"2026-10-27T18:56:06Z"},{"id":"a6","kind":"search","summary":"Searched: GitHub github.com API OAuth scopes redirect URI token expiration","target":"duckduckgo","outcome":"success","observed":"6 results","screenshot":null,"timestamp":"2026-10-27T18:56:06Z"},{"id":"a7","kind":"fetch_doc","summary":"Read https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps","target":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps","outcome":"success","observed":"HTTP 200, 7954 chars","screenshot":null,"timestamp":"2026-10-27T18:56:07Z"},{"id":"a8","kind":"fetch_doc","summary":"Read https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app","target":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app","outcome":"success","observed":"HTTP 200, 2144 chars","screenshot":null,"timestamp":"2026-10-27T18:56:07Z"},{"id":"a9","kind":"fetch_doc","summary":"Read https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps","target":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps","outcome":"success","observed":"HTTP 200, 25570 chars, kept the 11995 most relevant","screenshot":null,"timestamp":"2026-10-27T18:56:07Z"},{"id":"a10","kind":"fetch_doc","summary":"Read https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps","target":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps","outcome":"success","observed":"HTTP 200, 12067 chars, kept the 11019 most relevant","screenshot":null,"timestamp":"2026-10-27T18:56:07Z"},{"id":"a11","kind":"fetch_doc","summary":"Read https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/troubleshooting-oauth-app-access-token-request-errors","target":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/troubleshooting-oauth-app-access-token-request-errors","outcome":"failed","observed":"HTTP 404","screenshot":null,"timestamp":"2026-10-27T18:56:07Z"},{"id":"a12","kind":"fetch_doc","summary":"Read https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/troubleshooting-authorization-request-errors","target":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/troubleshooting-authorization-request-errors","outcome":"failed","observed":"HTTP 404","screenshot":null,"timestamp":"2026-10-27T18:56:07Z"},{"id":"a13","kind":"fetch_doc","summary":"Read https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/about-oauth-app-access-restrictions","target":"https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/about-oauth-app-access-restrictions","outcome":"success","observed":"HTTP 200, 3970 chars","screenshot":null,"timestamp":"2026-10-27T18:56:07Z"},{"id":"a14","kind":"fetch_doc","summary":"Read https://www.xnxx.com/search/family+brazzers","target":"https://www.xnxx.com/search/family+brazzers","outcome":"failed","observed":"ConnectError: ","screenshot":null,"timestamp":"2026-10-27T18:56:08Z"},{"id":"a15","kind":"fetch_doc","summary":"Read https://es.pornhub.com/video/search?search=brazzers+family","target":"https://es.pornhub.com/video/search?search=brazzers+family","outcome":"failed","observed":"ConnectError: ","screenshot":null,"timestamp":"2026-10-27T18:56:08Z"},{"id":"a16","kind":"fetch_doc","summary":"Read https://github.com/resources/articles/what-is-an-api","target":"https://github.com/resources/articles/what-is-an-api","outcome":"success","observed":"HTTP 200, 29414 chars, kept the 10126 most relevant","screenshot":null,"timestamp":"2026-10-27T18:56:08Z"},{"id":"a17","kind":"fetch_doc","summary":"Read https://www.pornpics.com/?q=brazzers+family","target":"https://www.pornpics.com/?q=brazzers+family","outcome":"failed","observed":"not about GitHub","screenshot":null,"timestamp":"2026-10-27T18:56:08Z"},{"id":"a18","kind":"fetch_doc","summary":"Read https://docs.github.com/en/apps/oauth-apps/building-oauth-apps","target":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps","outcome":"success","observed":"HTTP 200, 1478 chars","screenshot":null,"timestamp":"2026-10-27T18:56:09Z"},{"id":"a19","kind":"fetch_doc","summary":"Read https://docs.github.com/en/apps/using-github-apps/authorizing-github-apps","target":"https://docs.github.com/en/apps/using-github-apps/authorizing-github-apps","outcome":"success","observed":"HTTP 200, 4788 chars","screenshot":null,"timestamp":"2026-10-27T18:56:09Z"},{"id":"a20","kind":"fetch_doc","summary":"Read https://docs.github.com/en/apps/oauth-apps","target":"https://docs.github.com/en/apps/oauth-apps","outcome":"success","observed":"HTTP 200, 1108 chars","screenshot":null,"timestamp":"2026-10-27T18:56:09Z"},{"id":"a21","kind":"probe_endpoint","summary":"GET /.well-known/oauth-authorization-server","target":"https://github.com/.well-known/oauth-authorization-server","outcome":"success","observed":"HTTP 404","screenshot":null,"timestamp":"2026-10-27T18:56:24Z"},{"id":"a22","kind":"probe_endpoint","summary":"GET /.well-known/openid-configuration","target":"https://github.com/.well-known/openid-configuration","outcome":"success","observed":"HTTP 404","screenshot":null,"timestamp":"2026-10-27T18:56:24Z"},{"id":"a23","kind":"probe_endpoint","summary":"Authorization endpoint with an unregistered client_id","target":"https://github.com/login/oauth/authorize","outcome":"success","observed":"HTTP 302, redirecting to github.com/login","screenshot":null,"timestamp":"2026-10-27T18:56:25Z"},{"id":"a24","kind":"probe_endpoint","summary":"Token endpoint with fake credentials","target":"https://github.com/login/oauth/access_token","outcome":"success","observed":"HTTP 404, error code 'Not Found'","screenshot":null,"timestamp":"2026-10-27T18:56:25Z"},{"id":"a25","kind":"probe_endpoint","summary":"Developer console without signing in","target":"https://github.com/settings/developers","outcome":"success","observed":"HTTP 302, redirecting to github.com/login","screenshot":null,"timestamp":"2026-10-27T18:56:25Z"}],"stopped_reason":"Live generation reads public documentation and sends unauthenticated requests only. It does not sign in, create an app, or submit anything.","not_attempted":["Signing in to the developer console","Creating a test app","Submitting an app for review"]},"freshness":{"last_verified":"2026-10-28","recheck_after":"2027-01-26","changelog":[]}}