verapli
Sign inJoin free
Menu

Guides · auth · Popular APIs

GitHub OAuth app

Register an OAuth app under a user or organisation's Developer settings to get a client ID and secret for "Sign in with GitHub" or user-scoped API access.

Researched · not yet run liveLast researched 25 October 2026 · GitHub · provider site

Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Do this with verapliJSON for agents

Who owns what

An OAuth app is owned by a personal account or an organisation.

  • GitHub account or organisation developerPrefer an organisation for production apps so ownership is not tied to one person.

Steps

Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.

  1. Register the OAuth app

    Settings > Developer settings > OAuth apps > New OAuth App. Enter a public name, homepage URL and callback URL (up to 10); keep "Expire user access tokens" on if your app handles refresh tokens.

    • verapli co-pilot
    • Human step: You press submit

    Where: https://github.com/settings/applications/new

  2. Generate a client secret

    On the app page click Generate a new client secret and copy it; it is shown once [to verify wording].

    • verapli co-pilot
    • Human step: You press submit
    • After: Register the OAuth app

    verapli captures GITHUB_OAUTH_CLIENT_SECRET here by plain code: encrypted in your browser, never shown to AI.

    If something goes wrong (1)
    • Users have to sign in again after a period of inactivity: Refresh tokens expire after six months unused; send the user through the web or device flow again. [2]

    Where: https://github.com/settings/developers

  3. List on GitHub Marketplace (optional)optional

    Meet the listing requirements (privacy policy, support link, webhooks for plan changes); paid plans need a verified-publisher organisation and at least 200 users.

    • Guided by hand
    • Human step: The provider reviews it
    • After: Register the OAuth app

    Where: https://docs.github.com/en/apps/github-marketplace/creating-apps-for-github-marketplace/requirements-for-listing-an-app

Terms and gotchas

Plain-English summary, not legal advice. Each card links its source.

Worth knowingThe rules say

Expiring user access tokens last eight hours and refresh tokens expire after six months unused; apps must handle refresh or re-authorisation. [2]

What you end up with

Env varSecretFormatWhat it is
GITHUB_OAUTH_CLIENT_IDnot secretopaque id stringOAuth app client ID
GITHUB_OAUTH_CLIENT_SECRETsecretopaque secret stringOAuth app client secret

Pricing

  • No fee to register OAuth apps; limit 100 per user or organisation.

Source [1]

For agents

The same entry as JSON: /api/v1/entries/github/oauth-app · requirements /api/v1/requirements/github/oauth-app · terms /api/v1/terms/github/oauth-app.

Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp

> "What do I need for GitHub OAuth app, and how long will it take?"
  → tools/call requirements { "provider_id": "github/oauth-app" }

Sources

  1. Creating an OAuth app Settings > Developer settings > OAuth apps > New OAuth App; name, homepage URL, description, callback URL (up to 10), device flow, "Expire user access tokens" on by default; up to 100 OAuth apps per user or organisation. · accessed 25 October 2026 · official
  2. Authorizing OAuth apps Expiring access tokens last eight hours; refresh tokens expire after six months unused; client_secret needed for web flow code exchange; device flow uses client ID only. · accessed 25 October 2026 · official
  3. Requirements for listing an app Marketplace listing requirements; paid OAuth apps need a verified-publisher organisation and at least 200 users. · accessed 25 October 2026 · official

Provider rules change. This page is generated from verapli registry version 2026.1025.316; spotted something out of date? Tell us. GitHub is not affiliated with verapli.