[FR] GitHub authentication using a GitHub App

Summary

Looking at the docs it seems that currently only personal access tokens (either fine-grained or classic) are supported as a way to authenticate to GitHub and retrieve private repositories.

Would it be possible to support authenticating via GitHub Apps as well?

Details

The GitHub docs recommend using GitHub Apps over PATs for this type of long-lived integration.

Moreover for GitHub Enterprise Cloud setups, GitHub is charged per user account (which includes service accounts), so many companies will limit the number of service accounts and use GitHub Apps instead for automations.

A GitHub App can be installed on either entire GitHub organizations (including new repos within those orgs) or a selected set of repositories. This would help control the access SourceBot has (compared to a PAT, unless the PAT belongs to a dedicated service account).

The GitHub App has a private key, which can be used to create a temporary access token scoped to either an org or a repository, and then this token can be used to call the GitHub API. This is likely the logic that SourceBot would need to implement. Something like:

Let the user choose GitHub App as the authentication method and provide its ID and private key
When SourceBot needs to access the GitHub API, instead of simply taking the PAT from the config, it would take the private key, create the token scoped for the specific org, then use that

Since the token is scoped to either a repository or an organization, this means that it will need to be generated per-org (unlike the PAT that works across all orgs), so this is likely additional logic to be implemented.

Heya - yea this is something that could be supported in Sourcebot. Good callout w.r.t., service accounts being included in seat pricing for GHEC.

Since the token is scoped to either a repository or an organization, this means that it will need to be generated per-org (unlike the PAT that works across all orgs), so this is likely additional logic to be implemented.

Off the top of my head, it sounds like the flow will be (1) Admin creates a GitHub app and links it to Sourcebot, and (2) for that GitHub app, admin creates N app installations for the repos and orgs they want to index. There will need to be some relationship between the app installation and our Connection representation.

Thanks for the quick reply and putting it on your roadmap!

Off the top of my head, it sounds like the flow will be (1) Admin creates a GitHub app and links it to Sourcebot, and (2) for that GitHub app, admin creates N app installations for the repos and orgs they want to index. There will need to be some relationship between the app installation and our Connection representation.

I believe you are correct. The GitHub API does provide an endpoint to get all installations of an app, so those don't need to be manually configured.

@markszabo

Exactly @markszabo, @brendan-kellam . We are using this type of integration already for some other custom apps. We have an Enterprise app installed across all target organizations. A central service uses this GitHub App; after installation and authentication (using the key):

import { createAppAuth } from '@octokit/auth-app';
import { Octokit } from '@octokit/rest';

...
let octokit: Octokit;
...

  octokit = new Octokit({
    authStrategy: createAppAuth,
    auth: {
      appId: secret?.app_id,
      privateKey: secret?.private_key,
    },
  });

...

It retrieves the installations:

const installations = await octokit.paginate(octokit.rest.apps.listInstallations);

This is something which would be super useful in our case. We are looking for some workaround for this issue.

Sourcebot could help with that, especially if the configuration of organizations is automatically updated when new organizations have the Enterprise app installed and are therefore included in the index as well. Within our GHEC, only short-lived PATs are allowed, which makes it impossible to maintain in the current setup across all our organizations.

@markszabo

Hey @markszabo @lvthillo we shipped GitHub app auth recently and I just added it to the docs: https://docs.sourcebot.dev/docs/connections/github#authenticating-with-github

Please note that this was released as an EE feature and requires a license to use. Let me know if you have any questions! Closing this out for now

Navigation Menu

Repository navigation

[FR] GitHub authentication using a GitHub App #470

Summary

Details

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[FR] GitHub authentication using a GitHub App #470

Description

Summary

Details

Activity

brendan-kellam commented on Aug 19, 2025

markszabo commented on Aug 20, 2025

lvthillo commented on Oct 10, 2025

msukkari commented on Jan 17, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions