OAuth Readiness
Back to all apps

GitHub

Library guide, researched by Claude Code agents, checked 2026-10-19. Setup tested by hand on 2026-10-19.

GitHub has no app review: you register a GitHub App (recommended) or an OAuth App in Developer settings, set it to public, and any GitHub user can connect it within minutes. The real friction is on the user's side, because organizations decide whether your app may touch their repositories (an org owner must install a GitHub App, or approve an OAuth App when access restrictions are on, which is the default for new orgs).

Tier 1: Instant

Hands-on work
0.25–2 hours
Waiting for approval
None
Confidence
high

Assumes: A public GitHub App ("Any account" installation, user authorization enabled) that any external GitHub user can install and authorize so an AI agent can read and act on their repositories: repository permissions Contents read/write, Issues read/write, Pull requests read/write, Metadata read, plus account permission Email addresses read. The OAuth App equivalent would request the repo, read:org and user:email scopes.

10 min1 hour1 workday1 week1 month6 months

Solid dark bar: your hands-on work. Amber: the minimum wait. Hatched: the range sources disagree on, or an open-ended wait.[5][6]

Biggest blocker: There is no GitHub-side blocker; the practical blocker is per-customer: your app cannot reach an organization's repositories until an org owner installs the GitHub App (or approves the OAuth App under OAuth app access restrictions, on by default for new orgs).[14][16][17][18]

Why tier 1? Nothing gates this path.
The tier is computed from these seven facts by a fixed rule, not chosen by the AI. High: the gates that set this tier are backed by the provider's own docs or our own test.
Self-serve credentialsYesBoth GitHub Apps and OAuth Apps are registered self-serve in Developer settings under a personal account or an organization you own; the client ID and secret are issued immediately.[3][5][34]
Limits until reviewedNoThere is no user cap, test-user list or 'unverified app' screen. A GitHub App set to private ('Only on this account') can only be installed on the owning account; switching it to public removes that restriction with no review. OAuth Apps can be authorized by any GitHub user from the start.[6][8]
Provider reviewNoGitHub does not review GitHub Apps or OAuth Apps before external users connect. A public GitHub App can be installed and authorized by any GitHub user. Review applies only to GitHub Marketplace listings, which are optional. Organization owners may still need to install or approve your app for their org's resources, but that is a per-customer decision, not a GitHub review.[6][7][28][34]
Security assessmentNoNo third-party security assessment is required for GitHub Apps or OAuth Apps. Marketplace links to security best practices as a recommendation only. (no source)
Business verificationNoNot required to register or share an app. Publisher verification (organization-owned app) is required only to sell paid plans or display a badge on GitHub Marketplace, which is optional.[9][10][34]
Mandatory feesNoNo fees to register or publish an app; free Marketplace listings are allowed.[9][34]
Partner or paid accessNoThe REST and GraphQL APIs are available to any registered app with no partner program. Enterprise-level resources (the enterprise object itself) are not available to GitHub Apps; use an OAuth App for those.[29][34]

You can start today without any of this. Composio already provides a managed OAuth app for GitHub (github), so users can connect while you work through your own app. You need your own app for your brand on the consent screen, your own rate limits, or scopes beyond the defaults. Managed auth list

If your case is different

OAuth App instead of GitHub App
Also self-serve with no review, and simpler (no installation step), but it uses broad scopes (repo grants full read/write to every private repo the user can reach), tokens act as the user with no app attribution, and orgs with OAuth app access restrictions (default for new orgs) block it from org resources until an owner approves. GitHub recommends GitHub Apps; pick an OAuth App only if you need enterprise-level resources.
Sign-in only
A GitHub App with no repository permissions (or an OAuth App with no scopes / read:user) needs no installation and no org approval; users just authorize. Still no review.
Private / own org only
A GitHub App set to 'Only on this account' can only be installed on the owning account and only its org members can authorize it. Fine for internal agents; switch to public when you open it up.
GitHub Marketplace listing
Optional discovery channel, not required to let users connect. Free listings need a privacy policy, support contact, logo/screenshots, pricing plan and Marketplace webhook handling; paid plans additionally need publisher verification and 100 installations (GitHub App) or 200 users (OAuth App).

Steps

Agent steps an AI agent can do or draft for you. You steps that need your identity, accounts, legal authority or a real demo.

  1. Sign in to GitHub with the owning account

    You

    Use a personal account or, better, an organization you own (an org owner can later grant GitHub App manager to teammates). Account creation and 2FA need a human.[5]

  2. Decide GitHub App vs OAuth App

    Agent

    For an AI agent, register a GitHub App: fine-grained permissions, users choose which repos it can see, short-lived user tokens, scalable rate limits, and actions shown as the app on behalf of the user. Choose an OAuth App only for enterprise-level resources or if you want no installation step and accept broad scopes.[1][2][29]

  3. Register the GitHub App

    Agent

    Developer settings > GitHub Apps > New GitHub App. Enter a unique name (max 34 characters), homepage URL, up to 10 callback URLs, keep 'Expire user authorization tokens' on, optionally 'Request user authorization (OAuth) during installation', and set or disable the webhook.[5][26]

  4. Choose minimum permissions

    Agent

    Pick repository permissions (e.g. Contents, Issues, Pull requests read/write) and account permissions (e.g. Email addresses read). GitHub Apps ignore the OAuth scope parameter, so permissions here are what users grant.[32]

  5. Set installation to 'Any account' and create the app

    Agent

    Choose 'Any account' so it is public; then generate a client secret (and a private key if you will also use installation tokens) and store them in your agent backend.[6]

  6. Share the install link with users

    Agent

    Send users to https://github.com/apps/APP-NAME/installations/new (optionally with a state parameter). They install on their account/org, pick repositories, then authorize so you get a user access token.[28]

  7. Org owners install or approve per customer

    YouWait

    For organization repositories, members who cannot install trigger a request to the org owner. Timing depends entirely on each customer's admin; nothing is waiting on GitHub.[16][18]

  8. Optionally list on GitHub Marketplace

    You

    Not required. Requires accepting the Marketplace Developer Agreement (org owner only for org apps), a privacy policy link, support contact, images and pricing plan.[7][11][9][12]

What you will need

  • A GitHub account or organization you own to register the app under.[5]
  • A unique app name (max 34 characters) and a homepage URL (a public repo URL is accepted).[26]
  • Callback URL(s) for the user authorization flow (up to 10). Use HTTPS in production; http://localhost was accepted in our test.[5][34]
  • Only for an optional Marketplace listing: privacy policy URL, support link/email, logo, feature card, screenshots and a pricing plan.[11]

Nuances that catch people out

  • A GitHub App user token only reaches accounts where the app is installed. Authorizing alone is not enough: if the app is installed only on the user's personal account, it cannot see their organization's repos.[17]
  • Installing on an organization (or requesting organization permissions) needs an org owner; members and repo admins can only send a request.[16][18]
  • OAuth Apps: new organizations have OAuth app access restrictions on by default, so an OAuth App cannot touch that org's private resources until an owner approves it. GitHub Apps go through installation instead: they only see the repositories an org owner (or repo admin) granted.[13][14][15][27][30][31]
  • Expiring user tokens (on by default for new GitHub Apps and OAuth Apps) last 8 hours and refresh tokens 6 months; refresh tokens rotate (the old one stops working when used), so concurrent agent workers must serialize refreshes.[19][20][4]
  • Adding permissions later does not apply automatically: each installation owner must approve the new permissions, otherwise the installation keeps the old ones.[33]
  • OAuth App scopes are coarse: repo grants full read/write to all public and private repos the user can access.[24]
  • OAuth Apps: at most ten tokens per user/application/scope combination and ten new tokens per hour; older tokens get revoked beyond that.[21]
  • User access tokens do not get the scaling rate limit of installation tokens; OAuth App limits are lower and do not scale (GitHub's docs cite the user's 5,000 requests/hour).[22]
  • SAML SSO orgs: users must have an active SAML session for the org before authorizing, or org resources will be missing.[23]
  • Each user or org can register at most 100 GitHub Apps.[25]

If you get stuck or rejected

User authorized the app but the agent gets 404/empty results for their organization's repositories.
The app is not installed on that org (or not granted those repos). Have the user install it on the org or request installation from the org owner, then reselect repositories.[17][18]
OAuth App works on personal repos but not on an organization's private repos.
The org has OAuth app access restrictions enabled. The user requests approval and an org owner grants access under OAuth app policy, or switch to a GitHub App.[13][15]
Other users cannot find or install the app.
The GitHub App is private ('Only on this account'). Change it to public in the app settings.[8]
bad_refresh_token errors after a while.
The refresh token was already used (rotation) or is over six months old; store the newest pair atomically and re-run the authorization flow when it expires.[19][20]

Evidence

What we tested by hand

We registered a public GitHub App (installable by any account) with Contents read and Issues read/write permissions, then generated a client secret. It took 9 minutes with no review, approval, verification form or payment. Took 9 minutes.

StepDocs saidWe sawMatch
Sign in to GitHubA human must handle sign-in and 2FA.Signing in from a new device triggered device verification: a number match in the GitHub Mobile app, with an emailed code as the fallback.Yes
Callback URLOur guide listed HTTPS callback URLs as a requirement.http://localhost:3100/callback was accepted. HTTPS is still what you want in production, but local development works without it.No
Make it public ("Any account")No review is needed for a public GitHub App.No warning, review step or extra form when choosing Any account.Yes
Create the appSelf-serve, no approval or fees.Created instantly. No approval, verification or payment.Yes
Client secretGenerated from the app settings page.Generated instantly on the app page.Yes

What we could not verify

  • GitHub's docs do not explicitly state 'no review' for public GitHub Apps or OAuth Apps; the no-review conclusion is from the docs describing public apps as installable by any user with no review step outside Marketplace.
  • Review time for an optional Marketplace listing is not documented.

Sources

Each quote was checked by code against the live page. “Not found on page” means the quote may be paraphrased, so treat that claim with care.

  1. Differences between GitHub Apps and OAuth apps
    Provider docsQuote found on pagechecked 2026-10-19
    In general, GitHub Apps are preferred over OAuth apps. GitHub Apps use fine-grained permissions, give the user more control over which repositories the app can access, and use short-lived tokens.
  2. Deciding when to build a GitHub App
    Provider docsQuote found on pagechecked 2026-10-19
    Conversely, an OAuth app can access every repository that the user who authorized the app can access.
  3. Creating an OAuth app
    Provider docsQuote found on pagechecked 2026-10-19
    You can create and register an OAuth app under your personal account or under any organization you have administrative access to.
  4. Creating an OAuth app
    Provider docsQuote found on pagechecked 2026-10-19
    Expire user access tokens is enabled by default.
  5. Registering a GitHub App
    Provider docsQuote found on pagechecked 2026-10-19
    You can register a GitHub App under your personal account or under any organization you own.
  6. Making a GitHub App public or private
    Provider docsQuote found on pagechecked 2026-10-19
    If you set your GitHub App registration to public, any user on GitHub can install it and authorize it.
  7. Making a GitHub App public or private
    Provider docsQuote found on pagechecked 2026-10-19
    If your GitHub App is public to all users on GitHub, you can also choose to publish it to GitHub Marketplace.
  8. Making a GitHub App public or private
    Provider docsQuote found on pagechecked 2026-10-19
    If you set your GitHub App registration to private, it can only be installed on the account that owns the app.
  9. About GitHub Marketplace for apps
    Provider docsQuote found on pagechecked 2026-10-19
    Anyone can share their apps with other users for free on GitHub Marketplace but only apps owned by organizations can sell their app.
  10. About GitHub Marketplace for apps
    Provider docsQuote found on pagechecked 2026-10-19
    To publish paid plans for your app and display a marketplace badge, you must complete the publisher verification process.
  11. Requirements for listing an app
    Provider docsQuote found on pagechecked 2026-10-19
    Listings must have a valid link to a privacy policy.
  12. Requirements for listing an app
    Provider docsQuote found on pagechecked 2026-10-19
    GitHub Apps should have a minimum of 100 installations. OAuth apps should have a minimum of 200 users.
  13. About OAuth app access restrictions
    Provider docsQuote found on pagechecked 2026-10-19
    When OAuth app access restrictions are enabled, organization members and outside collaborators cannot authorize OAuth app access to organization resources.
  14. About OAuth app access restrictions
    Provider docsQuote found on pagechecked 2026-10-19
    When you create a new organization, OAuth app access restrictions are enabled by default.
  15. Approving OAuth apps for your organization
    Provider docsQuote found on pagechecked 2026-10-19
    When an organization member or outside collaborator requests OAuth app access to organization resources, organization owners can approve or deny the request.
  16. Differences between GitHub Apps and OAuth apps
    Provider docsQuote found on pagechecked 2026-10-19
    If a GitHub App is installed in a repository and requires organization permissions, the organization owner must approve the application.
  17. Authenticating with a GitHub App on behalf of a user
    Provider docsQuote found on pagechecked 2026-10-19
    The app can only access resources in an account where it is installed.
  18. Installing a GitHub App from a third party
    Provider docsQuote found on pagechecked 2026-10-19
    Instead of installing the app, GitHub will send a notification to the organization owner to request the organization owner to install the app.
  19. Refreshing user access tokens
    Provider docsQuote found on pagechecked 2026-10-19
    The user access token expires after eight hours, and the refresh token expires after six months.
  20. Refreshing user access tokens
    Provider docsQuote found on pagechecked 2026-10-19
    Once you use a refresh token, that refresh token and the old user access token will no longer work.
  21. Authorizing OAuth apps
    Provider docsQuote found on pagechecked 2026-10-19
    There is a limit of ten tokens that are issued per user/application/scope combination, and a rate limit of ten tokens created per hour.
  22. Differences between GitHub Apps and OAuth apps
    Provider docsQuote found on pagechecked 2026-10-19
    Conversely, OAuth apps have lower rate limits and do not scale.
  23. Authenticating with a GitHub App on behalf of a user
    Provider docsQuote found on pagechecked 2026-10-19
    If a user reports that they cannot see resources owned by their organization after authorizing your GitHub App and the organization uses SAML SSO, instruct the user to start an active SAML session for their organization before reauthorizing.
  24. Scopes for OAuth apps
    Provider docsQuote found on pagechecked 2026-10-19
    Grants full access to public and private repositories including read and write access to code, commit statuses, repository invitations, collaborators, deployment statuses, and repository webhooks.
  25. Registering a GitHub App
    Provider docsQuote found on pagechecked 2026-10-19
    A user or organization can register up to 100 GitHub Apps, but there is no limit to how many GitHub Apps can be installed on an account.
  26. Registering a GitHub App
    Provider docsQuote found on pagechecked 2026-10-19
    The name must be unique across GitHub.
  27. Differences between GitHub Apps and OAuth apps
    Provider docsQuote found on pagechecked 2026-10-19
    A GitHub App only has access to the repositories an organization owner has granted.
  28. Sharing your GitHub App
    Provider docsQuote found on pagechecked 2026-10-19
    If your GitHub App is public, other users and organizations can install your app.
  29. Deciding when to build a GitHub App
    Provider docsQuote found on pagechecked 2026-10-19
    Enterprise-level resources such as the enterprise object itself are not available to GitHub Apps.
  30. About OAuth app access restrictions
    Provider docsQuote found on pagechecked 2026-10-19
    When an organization has not set up OAuth app access restrictions, any OAuth app authorized by an organization member can also access the organization
  31. Limiting OAuth app and GitHub App access requests and installations
    Provider docsQuote found on pagechecked 2026-10-19
    By default, app access requests are enabled.
  32. Refreshing user access tokens
    Provider docsQuote found on pagechecked 2026-10-19
    The scope parameter does not grant permissions to a GitHub App.
  33. Choosing permissions for a GitHub App
    Provider docsQuote found on pagechecked 2026-10-19
    If the account owner does not approve the new permissions, their installation will continue to use the old permissions.
  34. Hands-on test: registering a GitHub App (2026-10-19)
    Tested by uschecked 2026-10-19