verapli
Sign inJoin free
Menu

Guides · devtools · Popular APIs

GitHub App

Register a GitHub App with fine-grained permissions and webhooks, generate a private key, and install it on accounts or repositories; paid Marketplace listings need a verified-publisher organisation.

Researched · not yet run liveLast researched 25 October 2026 · GitHub · provider site

Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Do this with verapliJSON for agents

Who owns what

A GitHub App is owned by a personal account or an organisation and is installed on accounts/repositories.

  • GitHub account or organisation (owner) developerPaid Marketplace listings require an organisation that is a verified publisher.

Have ready

  • A public HTTPS webhook URL (if the app receives events) [1]Needed for: Register the GitHub App

Steps

Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.

  1. Register the GitHub App

    Developer settings > GitHub Apps > New GitHub App. Enter a unique name (34 chars max), homepage, callback URL, webhook URL and secret, minimum permissions, events, and where it can be installed.

    • verapli co-pilot
    • Human step: You press submit

    verapli captures GITHUB_APP_WEBHOOK_SECRET here by plain code: encrypted in your browser, never shown to AI.

    Where: https://github.com/settings/apps/new

  2. Generate a private key

    Edit the app > Credentials > Key pairs > New key; a PEM file (PKCS#1 RSA) downloads. Store it safely; GitHub keeps only the public part.

    • verapli co-pilot
    • Human step: You press submit
    • After: Register the GitHub App
    If something goes wrong (1)
    • Library rejects the key format: The downloaded PEM is PKCS#1 RSAPrivateKey; convert if your library needs PKCS#8. [2]

    Where: https://github.com/settings/apps

  3. Install the app

    From the app's public page choose Install and pick the account and repositories.

    • verapli co-pilot
    • Human step: You press submit
    • After: Register the GitHub App

    Where: https://github.com/settings/apps

  4. List on GitHub Marketplace (optional)optional

    Meet listing requirements and accept the Marketplace Developer Agreement. Paid plans need a verified-publisher organisation (verified domain, support email, required 2FA) and at least 100 installations.

    • Guided by hand
    • Human step: The provider reviews it
    • After: Install the app

    Where: https://docs.github.com/en/apps/github-marketplace/creating-apps-for-github-marketplace/requirements-for-listing-an-app

Terms and gotchas

Plain-English summary, not legal advice. Each card links its source.

Can cost moneyThe rules say

Private keys never expire; revoke and rotate manually (up to 25 keys per app). [2]

Worth knowingThe rules say

Paid Marketplace listings need a verified-publisher organisation and at least 100 installations. [3]

What you end up with

Env varSecretFormatWhat it is
GITHUB_APP_IDnot secret123456Numeric App ID (shown on the app's General settings)
GITHUB_APP_CLIENT_IDnot secretopaque id stringApp client ID (for user access tokens)
GITHUB_APP_PRIVATE_KEYsecretPEM text block, or ./github-app.pemPEM private key file contents (PKCS#1 RSA) or path to it
GITHUB_APP_WEBHOOK_SECRETsecretrandom string you generateWebhook secret you chose at registration

Pricing

  • No fee to register; up to 100 GitHub Apps per user or organisation.

Source [1]

For agents

The same entry as JSON: /api/v1/entries/github/github-app · requirements /api/v1/requirements/github/github-app · terms /api/v1/terms/github/github-app.

Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp

> "What do I need for GitHub App, and how long will it take?"
  → tools/call requirements { "provider_id": "github/github-app" }

Sources

  1. Registering a GitHub App Settings > Developer settings > GitHub Apps > New GitHub App; name max 34 chars, unique; homepage; callback URLs (up to 10); webhook URL and secret (strongly recommended); permissions; events; install scope "Only on this account" or "Any account"; up to 100 GitHub Apps per user or organisation. · accessed 25 October 2026 · official
  2. Managing private keys for GitHub Apps Credentials > Key pairs > New key downloads a PEM (PKCS#1 RSA); up to 25 keys per app; keys don't expire and must be revoked manually; rotate with multiple keys. · accessed 25 October 2026 · official
  3. Requirements for listing an app All listings: publisher contact, description, pricing plan, privacy policy, support link, webhooks for plan changes, publicly available, Marketplace Developer Agreement; org-owned listings submitted by org owners; paid: verified-publisher org and at least 100 installations for GitHub Apps. · accessed 25 October 2026 · official
  4. About marketplace badges Verified publisher = org verified domain, confirmed support email, required 2FA; unverified publishers can't change pricing plans. · accessed 25 October 2026 · official

Provider rules change. This page is generated from verapli registry version 2026.1025.316; spotted something out of date? Tell us. GitHub is not affiliated with verapli.