Every claim is tagged: tested, sourced, reported, inferred or unknown. See how

← All guides
Researched guide

GitHub

Register an OAuth App in your GitHub settings. It is instant: no review, no waiting. Org-owned data may need an owner to approve the app.

Tier 1 · Self-serve10-20 min hands-onResearched 2026-10-20
DifficultyTier 1 · Self-serve

Sourced The registration page describes no review or approval step; the app is created when you click Register. [e1]

Your time (hands-on)10-20 min

Inferred Our estimate from the number of form fields and copy steps. No source states a setup time (Composio's guide shows only a 7-minute reading time).

Approval waitNo review

Sourced No review or approval step is mentioned on the registration page. Access to private organization resources can additionally require an organization owner to approve the app. [e1][e2]

Composio managed authAvailable

Sourced Composio's Github toolkit page lists OAuth2 and says 'Composio-managed OAuth available.' So a developer can connect users without registering their own provider app first; register your own only for your own branding, scopes or rate limits.

Open Composio's toolkit page

Who does what

An agent can

  • Explain the form fields and fetch the redirect URI from your Composio auth config via API.
  • Create the Composio auth config once you provide the client ID and secret through a secure input.
  • Run a test tool call after connection.

You must

  • Sign in to GitHub and register the OAuth app.
  • Handle the client secret yourself.
  • Ask an org owner to approve access if needed.

Steps

  1. Open Developer settingsYouSourced

    Profile picture (top right) > Settings > Developer settings > OAuth apps. If the app should belong to a team, do this from the organization's settings instead. [e1][e2]

    Why you: Needs your signed-in GitHub session.

  2. Get the callback URL from Composio firstYou or agentSourced

    In Composio, create an auth config for GitHub with 'Use your own developer credentials' and copy the redirect URI it shows. Do not trust a URL in a screenshot - Composio's guide says the screenshot is older than the current URI. [e2]

  3. Register the applicationYouSourced

    New OAuth App > enter name, homepage URL, optional description, and the authorization callback URL. Leave Device Flow off unless you need headless auth. Click Register application. [e1][e2]

    Why you: Needs your signed-in GitHub session.

  4. Copy the client ID and generate a client secretYouSourced

    Copy the Client ID. Generate a client secret and store it immediately in a secret manager or environment variable. [e2]

    Why you: The secret must go straight into your secret store; do not paste it into chats or commit it.

  5. Paste credentials into Composio and connectYou or agentSourced

    Enter client ID and secret in the auth config, then use Connect Account with a test user ID and authorize on GitHub. [e2]

Requirements

  • Sourced A GitHub account. You can register the app under your user or under an organization. [e1][e2]
  • Sourced Three inputs are implied by the form: application name, homepage URL and authorization callback URL. Description is optional. [e1]

Scopes and access

  • Sourced A user or organization can own up to 100 OAuth apps; each app can have up to 10 callback URLs. [e1]
  • Sourced Ask only for scopes the tools need. Composio's example uses broad scopes (repo, user, gist, notifications, project, workflow, codespace) and presents them as an example, not a recommendation. [e2]

Review process

  • Sourced No GitHub review step is described for registering an OAuth app; the page we read ends at 'Register application'. Organization owners may still need to approve it per org. [e1][e4]

Gotchas

  • Sourced Stay in 'OAuth Apps', not 'GitHub Apps' or personal access tokens - they are different products with different setup. [e2]
  • Sourced The client secret is shown only once; if lost, generate a new one and update Composio. [e2]
  • Sourced Do not put internal URLs or other sensitive data in the app's public fields. [e1]
  • Sourced 'Expire user access tokens' is on by default; turn it off only if your auth code does not support short-lived tokens. [e1]
  • Sourced New GitHub organizations have OAuth app access restrictions turned on by default, so your app may be blocked for org-owned repos until an owner approves it. Members can request that approval. [e3][e4]
  • Sourced If your product needs to act without a signed-in user, GitHub says GitHub Apps can act independently of a user; OAuth apps cannot. This guide covers OAuth apps only. [e5]

If you get stuck

Inferred redirect_uri mismatch error when authorizing

Likely cause: The callback URL in GitHub differs from the redirect URI in your current Composio auth config.

Fix: Copy the redirect URI from the Composio auth config and paste it as the callback URL in GitHub, exactly.

Escalate when: It still fails after an exact match - check which environment/auth config you are using. [e2]

Sourced Authorization works but private org repos are missing

Likely cause: An organization owner has to approve access before the app can reach private organization resources.

Fix: Use the Request button on the consent screen's organization section and ask an owner to approve.

Escalate when: The org restricts third-party app access and no owner responds. [e2]

Next actions

  • Register the app and copy credentials (about 10-20 min hands-on).
  • Connect a test account in Composio and run one simple GitHub tool to confirm scopes.

What was tested

Nothing here has been tested by hand yet.

What we are unsure about

  • GitHub's 'creating an OAuth app' page ends at 'Register application'; the client-secret step in this guide comes from Composio's guide, not GitHub's.
  • GitHub rate limits and token caps for OAuth apps were not quoted from an official page in this pass.
  • GitHub Apps (a different product) are not covered step by step here.
  • No hands-on registration has been logged yet.

Sources

  1. [e1] GitHub Docs - Creating an OAuth app
    A user or organization can own up to 100 OAuth apps.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  2. [e2] Composio - How to create GitHub OAuth credentials
    an organization owner might need to approve access before the app can reach private organization resources
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  3. [e3] GitHub Docs - About OAuth app access restrictions
    When you create a new organization, OAuth app access restrictions are enabled by default.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  4. [e4] GitHub Docs - About OAuth app access restrictions
    Users can request owner approval for OAuth apps they'd like to use.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  5. [e5] GitHub Docs - About creating GitHub Apps
    Unlike OAuth apps, GitHub Apps can also act independently of a user.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  6. [e6] Composio docs - Github toolkit, Authentication Details
    Composio-managed OAuth available
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page

Ask this guide

Questions about the ten library providers are answered from the guides, with the passage each answer rests on. For any other app it researches the web live and says so.

About the builder

Built by Moulshree Bhutra

Founding APM at Vudio.ai, applying for APM, Toolkits at Composio (Bangalore). This prototype is my answer to the take-home: a way for a developer to see the cost of an OAuth app before starting, and to trust what they read.

How I approached the problem

  • Started from what already exists. Composio publishes 46 setup guides. I read ten in full: they cover the clicking, but not setup time, difficulty or the approval wait, which is where teams lose weeks.
  • Designed for one decision. A developer asks "should I start this today?" So effort, wait, and what only you can do come first, and the steps come after.
  • Made trust visible. Every claim is tagged tested, sourced, reported, inferred or unknown, and quotes link to the page they came from. Where no provider states a number, the guide says so instead of guessing.
  • Kept the agent honest in code. The live agent cannot mark anything tested, and a quote it cannot find in a page it actually read is removed. The method page lists what was and was not checked.

Why I am a good fit

  • I have owned a product through integrations and AI. At Vudio.ai I worked across three roles as it grew from a video-commerce tool into an AI marketing platform with 10+ modules, including Shopify-connected widgets and the product side of its Campaign agent.
  • Results I can point to. I contributed to about 7x ARR growth ($30K to $0.2M) over two years through 0 to 1 launches. I redesigned Shoppable Widgets and built self-serve onboarding: activation rose about 74% and turnaround fell from 13 days to 4. I led AI Studio from 0 to 1 (ARPU up 5% among fashion brands) and built an analytics dashboard that lifted free-to-paid conversion about 10%.
  • I build to understand. I have a computer science degree and I prototype my own ideas, so I can talk to engineers about trade-offs. Top 3 of 200+ in NextLeap's Product Management Fellowship.
  • I write down what I do not know. This project lists its own gaps, including that the hands-on registrations are still being run.

Find me

Prototype built for the Composio APM, Toolkits take-home. It never asks for credentials or secrets.