← library
Self-serve
Developer tools·curated + hand-verified·checked 2026-10-28
difficulty
1/5

No approval gate. Register in about 10 minutes and any GitHub user can connect right away. The real decision is OAuth app vs GitHub App.

First working connection
~15 minutes
Production / approved
Same day (no provider review)
Composio managed OAuth
Available: ship today
Composio offers a managed GitHub OAuth app. Bring your own only for your brand on the consent screen, custom scopes, or a separate rate-limit quota.
who does itagent 4you 3provider 0
evidencetested 1sourced 17inferred 4

01Pick your path

OAuth app
when Your agent acts only as the signed-in user and broad scopes like repo are acceptable.
→ Fastest setup. Tokens can access every repo the user can.
GitHub App (recommended by GitHub)
when You want per-repo access, fine-grained permissions, short-lived tokens, or to act without a user.
→ Slightly more setup. Users choose which repos to grant, which security reviewers prefer.

02Time & effort

Hands-on work
1.1 h – 3.3 h
Waiting on others
0 – 3 days
You're actually working
4% of elapsed time
Phases
3
start↑ first working connection, then production pathproduction
  1. DEVRegister the app5–15 minutessourced[gh-create]
  2. DEVWire up the OAuth flow + token refresh1–3 hoursinferredOur estimate for a developer using an OAuth library.
  3. PRODOrg owners approve your app (only if the org restricts OAuth apps)wait 0–3 daysinferred[gh-orgrestrict]No GitHub review. The wait is the customer's org owner, if they enabled restrictions.
agent can do it you waiting on providerbar widths ∝ √time, so short tasks stay visible

03Steps

0/7 done

Get a working connection

  1. Choose OAuth app vs GitHub Appagentsourced[gh-create][gh-diff]

    GitHub's own docs nudge you toward a GitHub App: fine-grained permissions, user-selected repositories, short-lived tokens. Pick an OAuth app only if you need the simplest act-as-user flow.

  2. Register the app under a user or an org you administeryousourced[gh-create]

    Settings → Developer settings → OAuth apps → New OAuth App. Fill in name, homepage URL and authorization callback URL (up to 10 callback URLs). Use only public information; the form warns against internal URLs.

    ↗ github.com/settings/applications/new
  3. Or: open a pre-filled GitHub App registrationagentsourced[gh-url]

    GitHub Apps accept URL parameters on the registration page, so an agent can prepare the whole form and you review and click Create. Replace the callback URL with yours.

    ◆ prepared by agent · Pre-filled GitHub App registration link
    open ↗
    https://github.com/settings/apps/new?name=my-agent&description=AI agent integration&url=https://example.com&callback_urls[]=https://example.com/oauth/callback&request_oauth_on_install=true&public=true&contents=read&issues=write&webhook_active=false
  4. Generate a client secret and store it in your secret manageryouinferred

    Only you can see it in the app settings. Never commit it. Composio or your backend reads it from env.

  5. Handle expiring user tokensagentsourced[gh-create][gh-authz]

    'Expire user access tokens' is ON by default for new OAuth apps. Your integration must store and use refresh tokens, or uncheck the box until it does.

  6. Request the narrowest scopesagentsourced[gh-scopes]

    For OAuth apps, read:user and user:email cover identity. repo grants full control of private repos, so request it only if the agent writes code.

Make it production-ready

  1. Tell enterprise users how to get org approvalyousourced[gh-orgrestrict]

    If a customer's org enabled OAuth app access restrictions, members can't authorize your app for org resources until an org owner approves it. Put a 'request approval' note in your onboarding.

04Requirements, scopes & nuances

You'll need

  • ▸A GitHub personal account, or admin on the organization that will own the app. sourced[gh-create]
  • ▸A user or organization can own up to 100 OAuth apps. sourced[gh-create]
  • ▸No privacy policy, domain verification or security review required to go live. inferred[gh-create]

Gotchas

  • !OAuth app tokens can reach every repo the user can. Enterprise buyers often require a GitHub App instead. sourced[gh-diff]
  • !Org OAuth app access restrictions silently hide org repos from your token until an owner approves the app. sourced[gh-orgrestrict]
  • !Expiring tokens are the default. Code that stores only the access token breaks once it expires. sourced[gh-authz]
Scope / permissionTierNoteEvidence
read:userbasicRead profile data.sourced[gh-scopes]
user:emailbasicRead the user's email addresses.sourced[gh-scopes]
repobasicFull control of private repos. No review, but org owners and security teams will push back.sourced[gh-scopes]

05If you get blocked

✕Users connect fine but the agent can't see their company's repos.sourced[gh-orgrestrict]

→ The org has OAuth app restrictions. Ask the user to request approval (Settings → Applications) or have an org owner approve it, or switch to a GitHub App installed on the org.

✕redirect_uri mismatch error.sourced[gh-authz]

→ The redirect URI must match one of the registered callback URLs exactly (scheme, host, path).

06Evidence: what was tested, sourced, and still uncertain

$ probes: live GETs with a dummy client_id, no credentials
✓ Authorize endpoint with a fake client_id → 302
https://github.com/login/oauth/authorize?client_id=probe_invalid
Redirect to github.com/login?client_id=probe_invalid
∴ Endpoint is live. GitHub defers client validation until after login, so a bad client_id won't fail fast in testing.

Sources read

  1. [gh-create] GitHub Docs — Creating an OAuth app official
  2. [gh-diff] GitHub Docs — Differences between GitHub Apps and OAuth apps official
  3. [gh-authz] GitHub Docs — Authorizing OAuth apps official
  4. [gh-scopes] GitHub Docs — Scopes for OAuth apps official
  5. [gh-url] GitHub Docs — Registering a GitHub App using URL parameters official
  6. [gh-orgrestrict] GitHub Docs — About OAuth app access restrictions official
  7. [composio] Composio — Managed OAuth apps directory official
  8. [probe] Live HTTP probes run by the agent (dummy client_id, no credentials) probe

Still uncertain

  • ? We did not register a real app (that needs a signed-in GitHub account). Step order follows the docs, not a recorded attempt.
  • ? The implementation-time estimate is ours, not GitHub's.
  • ? GitHub Marketplace listing (optional, for paid apps) has its own review that this guide does not cover.