GitHub

Instant: register an OAuth app or GitHub App in minutes, with no review. The only friction is org owners approving your app when an org has OAuth app access restrictions on.

Difficulty

1/5 · Instant

Approval

none

Confidence

high

Test before approval

Yes

Why this score

• Register an OAuth app or GitHub App (self-serve, weight 1)

• Choose GitHub App vs OAuth app (both) — done when: App type and scopes or permissions are written down.
• Register the app (human) — done when: You have a client ID and client secret.
• Wire it into Composio (both) — done when: A Composio session uses your auth config ID for github.

• mediumOrg OAuth app access restrictions are on by default for new orgs. Members can't grant your OAuth app access to org resources until an owner approves it. (Pilot-ready)Workaround: Ask the org owner to approve the app, or ship a GitHub App that the org installs on selected repositories.An agent can help with this.
• lowExpiring user tokens are on by default. Code written for older tutorials that assume non-expiring tokens breaks after 8 hours. (Dev-ready)Workaround: Implement the refresh flow, or uncheck the setting until you do.An agent can help with this.

• GitHub account with 2FA (human · Dev-ready): A personal account, or admin access to the organization that will own the app.
• Decide: GitHub App or OAuth app (both · Dev-ready): GitHub recommends GitHub Apps (fine-grained permissions, per-repository install, short-lived tokens). OAuth apps act only on behalf of a user and use coarse scopes such as repo.
• Homepage URL and callback URL (both · Dev-ready): Homepage URL is required. The callback URL comes from the Composio dashboard if you use Composio. No privacy policy, logo or domain verification is required to register.

• Register an OAuth app or GitHub App (self serve)Applies when: always. Required for Pilot-ready, Production-ready.Cost: Free. A user or organization can own up to 100 OAuth apps.primarysource
• Org OAuth app access restrictions (admin consent)Applies when: only if the target org has OAuth app restrictions enabled (default for new orgs). Conditional — not scored.Duration: Depends on each org owner. GitHub publishes no timeline because it is the customer's decision.inferred

1. Choose GitHub App vs OAuth app (decide · both · ~5 min)
   • Use a GitHub App if you need per-repository access or want to act as the app; use an OAuth app if you only act as the signed-in user.
   • Keep the scope list to what the agent actually calls.
   Done when: App type and scopes or permissions are written down.
2. Register the app (create · human · ~5 min)
   • Settings → Developer settings → OAuth apps → New OAuth App.
   • Fill Application name, Homepage URL and Authorization callback URL (up to 10).
   • Leave "Expire user access tokens" enabled unless your code can't refresh tokens yet.
   • Click Register application, then generate a client secret.
   Done when: You have a client ID and client secret.
3. Wire it into Composio (configure · both · ~5 min)
   • In Composio, Create Auth Config → GitHub → OAuth2, and copy the redirect URI it shows into the GitHub callback URL.
   • Paste the client ID and secret back into Composio and pass the auth config ID in your session.
   Done when: A Composio session uses your auth config ID for github.
4. Authorize yourself and a user in a restricted org (test · both · ~10 min)
   • Connect your own account and call one API endpoint.
   • Connect an account in an org with OAuth app restrictions and confirm the org-approval request path works.
   Done when: A token works for personal repos, and you know what an org owner must click.

Redirect URIs:

Up to 10 callback URLs per OAuth app.primarysource

PKCE:

Supported with S256; GitHub calls code_challenge "strongly recommended".tested · probesource

Token lifetime:

With expiring tokens (on by default for new OAuth apps): access token 8 hours, refresh token 6 months without use.primarysource

Refresh:

Refresh tokens are returned when expiring tokens are on, or per sign-in when you request the offline_access scope.primarysource

Rate limits:

5,000 requests per hour per user for OAuth-app requests made on a user's behalf (15,000 for GitHub Enterprise Cloud orgs).primarysource

• GET https://github.com/.well-known/openid-configuration → 404No discovery document at the root path. (2026-10-19T20:37:16Z)
• GET https://github.com/.well-known/oauth-authorization-server/login/oauth → 200RFC 8414 metadata: issuer https://github.com/login/oauth, code_challenge_methods_supported [S256], grants authorization_code, refresh_token, device_code. (2026-10-19T20:38:49Z)
• GET https://github.com/login/oauth/authorize?client_id=oauth-atlas-probe&redirect_uri=https%3A%2F%2Fexample.com%2Fcb → 302 → https://github.com/login?client_id=oauth-atlas-probe&return_to=%2Flogin%2Foauth%2Fauthorize%3Fclient_id%3Doauth-atlas-probe%26redirect_uri%3Dhttps%253A%252F%252Fexample.com%252FcbUnauthenticated request redirects to login before validating the client_id. (2026-10-19T20:37:17Z)

• [ev-create] OAuth apps take up to 10 callback URLs and expire user tokens by default. primary high confidence

  You can enter up to 10 callback URLs.

  https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-appofficial-doc · retrieved 2026-10-19T20:37:55Z
• [ev-tokens] Access tokens last 8 hours; refresh tokens 6 months without use. primary high confidence

  The access token expires after eight hours, and the refresh token expires after six months without use.

  https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-appsofficial-doc · retrieved 2026-10-19T20:37:56Z
• [ev-diff] GitHub Apps are generally preferred over OAuth apps. primary high confidence

  In general, GitHub Apps are preferred over OAuth apps.

  https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-appsofficial-doc · retrieved 2026-10-19T20:37:57Z
• [ev-restrictions] OAuth app access restrictions are enabled by default for new organizations. primary high confidence

  When you create a new organization, OAuth app access restrictions are enabled by default.

  https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/about-oauth-app-access-restrictionsofficial-doc · retrieved 2026-10-19T20:37:58Z
• [ev-scopes] The repo scope grants full access to public and private repositories. primary high confidence

  Grants full access to public and private repositories including read and write access to code

  https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-appsofficial-doc · retrieved 2026-10-19T20:38:00Z
• [ev-rate] User-to-server requests share a 5,000 requests/hour budget. primary high confidence

  All of these requests count towards your personal rate limit of 5,000 requests per hour.

  https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-apiofficial-doc · retrieved 2026-10-19T20:38:00Z
• [ev-discovery] GitHub publishes RFC 8414 and OIDC discovery documents (public preview) under the issuer https://github.com/login/oauth. primary high confidence

  GitHub publishes two metadata documents used in the OAuth 2.0 and OpenID Connect protocols

  https://docs.github.com/en/apps/github-authentication-discovery-endpointsofficial-doc · retrieved 2026-10-19T20:38:39Z
• [ev-probe-pkce] The RFC 8414 metadata advertises PKCE S256. tested high confidence

  "code_challenge_methods_supported":["S256"]

  https://github.com/.well-known/oauth-authorization-server/login/oauthtest · retrieved 2026-10-19T20:38:49Z
• [ev-composio-byo] For OAuth toolkits, the Composio dashboard shows the redirect URI to register with the provider. primary high confidence

  For OAuth toolkits, the dashboard shows the redirect URI to add in the provider's developer portal.

  https://docs.composio.dev/docs/authentication/custom-app-vs-managed-appofficial-doc · retrieved 2026-10-19T20:38:04Z

• Whether Composio's managed GitHub toolkit uses an OAuth app or a GitHub App, and which scopes it requests.
• Registration form fields as seen in the console today: pending the T-011 attempt.
• GitHub Marketplace listing review time (optional path; not researched).

• 2026-10-20: OAuth app callback URLs and token expiry — One callback URL per OAuth app; user tokens never expire. → Up to 10 callback URLs; "Expire user access tokens" is on by default (8 h access / 6-month refresh). (Older tutorials predate the current docs.)
• 2026-10-20: GitHub OAuth discovery — GitHub has no OAuth discovery document (research.md §6.1 probe: 404). → The root /.well-known/openid-configuration is 404, but GitHub publishes RFC 8414 and OIDC metadata under the issuer https://github.com/login/oauth (public preview, intended for MCP clients). (The earlier probe only tried the root path.)