{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"entry_sha256":"c0cca66cceaac1790095d7873ec1b660820db6caa27aa228171d433ee247d459","entry":{"id":"github/oauth-app","name":"GitHub OAuth app","vendor":"GitHub","summary":"Register an OAuth app under a user or organisation's Developer settings to get a client ID and secret for \"Sign in with GitHub\" or user-scoped API access.","category":"auth","group":"C","homepage":"https://docs.github.com/en/apps/oauth-apps","docs":["https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app","https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"],"status":"researched","last_verified":null,"last_researched":"2026-10-25","sources":[{"id":"creating","url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app","title":"Creating an OAuth app","accessed":"2026-10-25","supports":"Settings > Developer settings > OAuth apps > New OAuth App; name, homepage URL, description, callback URL (up to 10), device flow, \"Expire user access tokens\" on by default; up to 100 OAuth apps per user or organisation.","kind":"official"},{"id":"authorizing","url":"https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps","title":"Authorizing OAuth apps","accessed":"2026-10-25","supports":"Expiring access tokens last eight hours; refresh tokens expire after six months unused; client_secret needed for web flow code exchange; device flow uses client ID only.","kind":"official"},{"id":"marketplace_reqs","url":"https://docs.github.com/en/apps/github-marketplace/creating-apps-for-github-marketplace/requirements-for-listing-an-app","title":"Requirements for listing an app","accessed":"2026-10-25","supports":"Marketplace listing requirements; paid OAuth apps need a verified-publisher organisation and at least 200 users.","kind":"official"}],"allowed_domains":["github.com"],"account_model":{"summary":"An OAuth app is owned by a personal account or an organisation.","accounts":[{"name":"GitHub account or organisation","kind":"developer","required":true,"note":"Prefer an organisation for production apps so ownership is not tied to one person."}]},"steps":[{"id":"register","title":"Register the OAuth app","summary":"Settings > Developer settings > OAuth apps > New OAuth App. Enter a public name, homepage URL and callback URL (up to 10); keep \"Expire user access tokens\" on if your app handles refresh tokens.","route":"copilot","depends_on":[],"gate":"human_submit","url":"https://github.com/settings/applications/new","sources":["creating"]},{"id":"client_secret","title":"Generate a client secret","summary":"On the app page click Generate a new client secret and copy it; it is shown once [to verify wording].","route":"copilot","depends_on":["register"],"gate":"human_submit","url":"https://github.com/settings/developers","recovery":[{"hiccup":"Users have to sign in again after a period of inactivity","fix":"Refresh tokens expire after six months unused; send the user through the web or device flow again.","source":"authorizing"}],"capture":{"env":"GITHUB_OAUTH_CLIENT_SECRET","kind":"secret"}},{"id":"marketplace","title":"List on GitHub Marketplace (optional)","summary":"Meet the listing requirements (privacy policy, support link, webhooks for plan changes); paid plans need a verified-publisher organisation and at least 200 users.","route":"guided","depends_on":["register"],"gate":"third_party_review","url":"https://docs.github.com/en/apps/github-marketplace/creating-apps-for-github-marketplace/requirements-for-listing-an-app","optional":true,"sources":["marketplace_reqs"]}],"outputs":[{"name":"GITHUB_OAUTH_CLIENT_ID","description":"OAuth app client ID","secret":false,"example_format":"opaque id string","from_step":"register"},{"name":"GITHUB_OAUTH_CLIENT_SECRET","description":"OAuth app client secret","secret":true,"example_format":"opaque secret string","from_step":"client_secret"}],"terms_notes":[{"kind":"rules_say","severity":"yellow","text":"Expiring user access tokens last eight hours and refresh tokens expire after six months unused; apps must handle refresh or re-authorisation.","source":"authorizing"}],"pricing_notes":{"notes":"No fee to register OAuth apps; limit 100 per user or organisation.","source":"creating"},"stripe_projects":false,"api_provisioning":{"available":"no","notes":"OAuth apps are registered in the web UI."}}}