VerifiedResearched 2026-10-28Confidence high

GitHub

GitHub (Microsoft) · github.com · Developer portal

Tier 2 · Self-serve, optional reviewCustomer-side gate

GitHub does not review your app. Any user can install a public GitHub App. The deciding factor is the customer: an org owner must install it for org repos.

sourced

Customer-side gate: An org owner installs a GitHub App. A repo admin can instead if you request no organization permissions or Repository administration, unless the owner blocks it. OAuth apps need owner approval in new orgs.

App types (2)

GitHub App (recommended): Default for agents. Fine-grained permissions, installer-picked repos, 8-hour user tokens with refresh. Exempt from org OAuth app restrictions.
OAuth app: Only for enterprise-level resources or all-repo access without an install. repo is full read and write. Org owners must approve it by default.

Docs read(reached)
Endpoints probed(reached)
Portal checked(reached)
Set up by a person(not reached)

Evidence: 0 tested, 2 probed, 30 sourced, 2 inferred

Generate a live guide to compare with this one.

Next step

Open github.com/settings/apps/new, or for an org go to Settings > Developer settings > GitHub Apps > New GitHub App. Enter name, homepage URL, and callback URL. Keep Expire user authorization tokens checked, choose Only on this account, and click Create GitHub App. The settings page shows the App ID and Client ID.

https://github.com/settings/apps/new

0 of 12

What does your agent need?

Select everything it does. Scopes decide the tier.

2Your tier: Self-serve, optional reviewAny user can connect. Review applies only to a public listing or higher limits.

Start today

Composio-managed OAuth: Yes

sourced

Composio provides managed OAuth for GitHub. Users see Composio on the consent screen, and you share its rate limit and default permissions. Bring your own GitHub App for your own name, permissions, or rate limit: add its client ID and secret to an auth config, and link users to your install page. Only new connections use the new auth config. Existing users keep theirs until they re-authenticate or you import their credentials.

Time and effort

You can build while you wait.

Stage	Who can connect	Hands-on	Waiting	Review
Prototype	You and your own org. The app installs only on your account. sourced You register a GitHub App under Settings, Developer settings, GitHub Apps. The name is up to 34 characters and unique across GitHub. You can add up to 10 callback URLs. You choose whether the app installs only on your account or on any account. One account can own up to 100 GitHub Apps. Registering a GitHub App The page does not state form defaults. It tells you to deselect Expire user authorization tokens and webhook Active if you do not want them, and to select Enable Device Flow if you do, which implies tokens expire and webhooks are on by default and device flow is off. sourced · official docs · 2026-10-28 sourced A public GitHub App can be installed and authorized by any GitHub user and can be listed on Marketplace. A private one installs only on the owning account, and only members of the owning org can authorize it. Making a GitHub App public or private sourced · official docs · 2026-10-28	1 h to 3 h	none	No
Limited beta	Any GitHub user. Org repos need an install by an owner or repo admin. sourced A public GitHub App can be installed and authorized by any GitHub user and can be listed on Marketplace. A private one installs only on the owning account, and only members of the owning org can authorize it. Making a GitHub App public or private sourced · official docs · 2026-10-28 sourced Repository admins can install a third-party GitHub App in their org only if it requests no organization permissions and not Repository administration. Members and outside collaborators can request an install, and owners get notified. Installers choose all repositories or selected ones. Owners can block repo admins from installing apps, and then only an owner can install. Installing a GitHub App from a third party sourced · official docs · 2026-10-28 inferred How long an org owner takes to approve or install your app depends on each customer. GitHub gives no timeline, so the wait can range from minutes to never. Owner approval is a customer decision (e10, e14, e15). No source gives a duration. inferred · reasoning · 2026-10-28	2 h to 6 h	none	No
Production	Anyone on GitHub. Marketplace listing is optional. sourced User tokens (personal tokens, OAuth app tokens, GitHub App user tokens) share 5,000 REST requests per hour per user. Installation tokens start at 5,000 and grow with repos and users up to 12,500, or 15,000 on Enterprise Cloud orgs. Rate limits for the REST API sourced · official docs · 2026-10-28 sourced Anyone can list a free app on GitHub Marketplace. Only organization-owned apps whose org has completed publisher verification can sell paid plans. About GitHub Marketplace for apps sourced · official docs · 2026-10-28 sourced Marketplace listings need a valid privacy policy link, a support link or email, value beyond authentication, a publicly available app, Marketplace webhook events, and acceptance of the Marketplace Developer Agreement. Paid listings need 100 installs for a GitHub App or 200 users for an OAuth app. No review timeline is given. Requirements for listing an app sourced · official docs · 2026-10-28 sourced When you request publication of a Marketplace listing, GitHub sends it for review and an onboarding expert contacts you. No timeline is given. Submitting your listing for publication sourced · official docs · 2026-10-28	2 h to 8 h	none	No

Prototype: No review. A private GitHub App installs only on its owner account.
Limited beta: GitHub adds no wait. Each customer org may wait on its owner, with no timeline.
Production: No GitHub approval. Marketplace listings get a review with no stated timeline; your app works meanwhile. Paid plans need 100 installs and a verified publisher org.

Scopes

Scopes that match your selection are marked.

Sign-in and profileNo review · Read data
GitHub App with no repository permissions OAuth: read:user OAuth: user:email
No review and no org approval.
sourced
A GitHub App user access token only has permissions that both the user and the app have. User tokens come from the web flow (PKCE S256 supported), device flow, or authorization during install, and expire after 8 hours with a 6 month refresh token.
Generating a user access token for a GitHub App
sourced · official docs · 2026-10-28
sourced
The repo scope grants full read and write access to public and private repositories. There is no read-only scope for private repository code. Users can edit granted scopes, so check the X-OAuth-Scopes header.
Scopes for OAuth apps
sourced · official docs · 2026-10-28
Read repos, issues, and PRsNo review · Read data
Contents: read Issues: read Pull requests: read Metadata: read OAuth: repo (no read-only option for private repos)
Org repos need an owner or repo admin install. OAuth apps must request repo (full read and write).
sourced
Repository admins can install a third-party GitHub App in their org only if it requests no organization permissions and not Repository administration. Members and outside collaborators can request an install, and owners get notified. Installers choose all repositories or selected ones. Owners can block repo admins from installing apps, and then only an owner can install.
Installing a GitHub App from a third party
sourced · official docs · 2026-10-28
sourced
The repo scope grants full read and write access to public and private repositories. There is no read-only scope for private repository code. Users can edit granted scopes, so check the X-OAuth-Scopes header.
Scopes for OAuth apps
sourced · official docs · 2026-10-28
sourced
GitHub Apps let you ask for read-only contents access instead of the write access the repo scope grants. Actions taken with a user token are labeled as the app acting for the user.
Deciding when to build a GitHub App
sourced · official docs · 2026-10-28
Write: open issues, comment, push branches, open PRsNo review · Write data
Contents: read and write Issues: read and write Pull requests: read and write Workflows: write (only to edit .github/workflows) OAuth: repo, workflow
Write permissions show on the install screen. Security-minded orgs ask more questions.
sourced
You register a GitHub App under Settings, Developer settings, GitHub Apps. The name is up to 34 characters and unique across GitHub. You can add up to 10 callback URLs. You choose whether the app installs only on your account or on any account. One account can own up to 100 GitHub Apps.
Registering a GitHub App
The page does not state form defaults. It tells you to deselect Expire user authorization tokens and webhook Active if you do not want them, and to select Enable Device Flow if you do, which implies tokens expire and webhooks are on by default and device flow is off.
sourced · official docs · 2026-10-28
sourced
Repository admins can install a third-party GitHub App in their org only if it requests no organization permissions and not Repository administration. Members and outside collaborators can request an install, and owners get notified. Installers choose all repositories or selected ones. Owners can block repo admins from installing apps, and then only an owner can install.
Installing a GitHub App from a third party
sourced · official docs · 2026-10-28
sourced
The repo scope grants full read and write access to public and private repositories. There is no read-only scope for private repository code. Users can edit granted scopes, so check the X-OAuth-Scopes header.
Scopes for OAuth apps
sourced · official docs · 2026-10-28
Background access (agent acts while the user is away)No review · Act while offline
User token refresh (8 h access, 6 month refresh) Installation token from your app's private key (about 1 h) OAuth: offline_access
Rotate refresh tokens; each refresh kills the old pair. Installation tokens act as a bot without a user.
sourced
Installing a GitHub App on an organization needs an organization owner or admin permission on a repository. Installation tokens expire after about one hour and act as a bot.
Differences between GitHub Apps and OAuth apps
sourced · official docs · 2026-10-28
sourced
Expiring user tokens last 8 hours and come with a refresh token that lasts 6 months. A refresh returns a new pair and the old refresh and access tokens stop working. Scopes cannot change on refresh.
Authorizing OAuth apps
sourced · official docs · 2026-10-28
sourced
A GitHub App user access token only has permissions that both the user and the app have. User tokens come from the web flow (PKCE S256 supported), device flow, or authorization during install, and expire after 8 hours with a 6 month refresh token.
Generating a user access token for a GitHub App
sourced · official docs · 2026-10-28
Org administrationNo review · Admin-level
Organization permissions such as Members or Administration Repository administration OAuth: admin:org, write:org
Only an org owner can install the app. Repo admins cannot.
sourced
Repository admins can install a third-party GitHub App in their org only if it requests no organization permissions and not Repository administration. Members and outside collaborators can request an install, and owners get notified. Installers choose all repositories or selected ones. Owners can block repo admins from installing apps, and then only an owner can install.
Installing a GitHub App from a third party
sourced · official docs · 2026-10-28
sourced
The repo scope grants full read and write access to public and private repositories. There is no read-only scope for private repository code. Users can edit granted scopes, so check the X-OAuth-Scopes header.
Scopes for OAuth apps
sourced · official docs · 2026-10-28

Requirements

A GitHub account (personal or organization) to own the app PrototypeUse an organization if you may sell on Marketplace. Paid listings must be org-owned.
sourced
You register a GitHub App under Settings, Developer settings, GitHub Apps. The name is up to 34 characters and unique across GitHub. You can add up to 10 callback URLs. You choose whether the app installs only on your account or on any account. One account can own up to 100 GitHub Apps.
Registering a GitHub App
The page does not state form defaults. It tells you to deselect Expire user authorization tokens and webhook Active if you do not want them, and to select Enable Device Flow if you do, which implies tokens expire and webhooks are on by default and device flow is off.
sourced · official docs · 2026-10-28
sourced
Anyone can list a free app on GitHub Marketplace. Only organization-owned apps whose org has completed publisher verification can sell paid plans.
About GitHub Marketplace for apps
sourced · official docs · 2026-10-28
A unique app name, 34 characters or fewer Prototypeagent can help
sourced
You register a GitHub App under Settings, Developer settings, GitHub Apps. The name is up to 34 characters and unique across GitHub. You can add up to 10 callback URLs. You choose whether the app installs only on your account or on any account. One account can own up to 100 GitHub Apps.
Registering a GitHub App
The page does not state form defaults. It tells you to deselect Expire user authorization tokens and webhook Active if you do not want them, and to select Enable Device Flow if you do, which implies tokens expire and webhooks are on by default and device flow is off.
sourced · official docs · 2026-10-28
Homepage URL Prototypeagent can helpA public repo or your account URL works if you have no site.
sourced
You register a GitHub App under Settings, Developer settings, GitHub Apps. The name is up to 34 characters and unique across GitHub. You can add up to 10 callback URLs. You choose whether the app installs only on your account or on any account. One account can own up to 100 GitHub Apps.
Registering a GitHub App
The page does not state form defaults. It tells you to deselect Expire user authorization tokens and webhook Active if you do not want them, and to select Enable Device Flow if you do, which implies tokens expire and webhooks are on by default and device flow is off.
sourced · official docs · 2026-10-28
Callback URLs (up to 10) Prototypeagent can helpAdd production and local URLs. Locally use 127.0.0.1, any port. Keep wildcard matching off.
sourced
With wildcard matching off, redirect_uri must match a callback URL exactly. For loopback redirects the port may differ, and GitHub recommends 127.0.0.1 or ::1 over localhost.
Authorizing OAuth apps
sourced · official docs · 2026-10-28
sourced
You register a GitHub App under Settings, Developer settings, GitHub Apps. The name is up to 34 characters and unique across GitHub. You can add up to 10 callback URLs. You choose whether the app installs only on your account or on any account. One account can own up to 100 GitHub Apps.
Registering a GitHub App
The page does not state form defaults. It tells you to deselect Expire user authorization tokens and webhook Active if you do not want them, and to select Enable Device Flow if you do, which implies tokens expire and webhooks are on by default and device flow is off.
sourced · official docs · 2026-10-28
sourced
Wildcard matching is set per callback URL. When on, any subdomain or subdirectory is accepted but the base host and port must match. Apps with a single callback URL from before Aug 3, 2026 have it on by default, and GitHub suggests turning it off if you do not need it.
About the user authorization callback URL
sourced · official docs · 2026-10-28
Minimum permissions list Prototypeagent can helpRead-only where possible. Skip org permissions and Repository administration.
sourced
Repository admins can install a third-party GitHub App in their org only if it requests no organization permissions and not Repository administration. Members and outside collaborators can request an install, and owners get notified. Installers choose all repositories or selected ones. Owners can block repo admins from installing apps, and then only an owner can install.
Installing a GitHub App from a third party
sourced · official docs · 2026-10-28
sourced
GitHub Apps let you ask for read-only contents access instead of the write access the repo scope grants. Actions taken with a user token are labeled as the app acting for the user.
Deciding when to build a GitHub App
sourced · official docs · 2026-10-28
Private key and client secret stored as secrets PrototypeThe private key mints installation tokens. The client secret exchanges user codes.
sourced
Installing a GitHub App on an organization needs an organization owner or admin permission on a repository. Installation tokens expire after about one hour and act as a bot.
Differences between GitHub Apps and OAuth apps
sourced · official docs · 2026-10-28
sourced
A GitHub App user access token only has permissions that both the user and the app have. User tokens come from the web flow (PKCE S256 supported), device flow, or authorization during install, and expire after 8 hours with a 6 month refresh token.
Generating a user access token for a GitHub App
sourced · official docs · 2026-10-28
Webhook URL and secret, or webhooks turned off Limited betaagent can helpWebhooks are on by default. Turn them off if you do not need events.
sourced
You register a GitHub App under Settings, Developer settings, GitHub Apps. The name is up to 34 characters and unique across GitHub. You can add up to 10 callback URLs. You choose whether the app installs only on your account or on any account. One account can own up to 100 GitHub Apps.
Registering a GitHub App
The page does not state form defaults. It tells you to deselect Expire user authorization tokens and webhook Active if you do not want them, and to select Enable Device Flow if you do, which implies tokens expire and webhooks are on by default and device flow is off.
sourced · official docs · 2026-10-28
Privacy policy and support contact Productionagent can helpRequired for Marketplace. Org owners check for them.
sourced
Marketplace listings need a valid privacy policy link, a support link or email, value beyond authentication, a publicly available app, Marketplace webhook events, and acceptance of the Marketplace Developer Agreement. Paid listings need 100 installs for a GitHub App or 200 users for an OAuth app. No review timeline is given.
Requirements for listing an app
sourced · official docs · 2026-10-28
Verified publisher organization (paid Marketplace plans only) ProductionAlso needs 100 installs and monthly and annual plans.
sourced
Anyone can list a free app on GitHub Marketplace. Only organization-owned apps whose org has completed publisher verification can sell paid plans.
About GitHub Marketplace for apps
sourced · official docs · 2026-10-28
sourced
Marketplace listings need a valid privacy policy link, a support link or email, value beyond authentication, a publicly available app, Marketplace webhook events, and acceptance of the Marketplace Developer Agreement. Paid listings need 100 installs for a GitHub App or 200 users for an OAuth app. No review timeline is given.
Requirements for listing an app
sourced · official docs · 2026-10-28

Steps

Prototype

Register a GitHub AppYou10 to 20 min
Open github.com/settings/apps/new, or for an org go to Settings > Developer settings > GitHub Apps > New GitHub App. Enter name, homepage URL, and callback URL. Keep Expire user authorization tokens checked, choose Only on this account, and click Create GitHub App. The settings page shows the App ID and Client ID.
https://github.com/settings/apps/new
sourced
You register a GitHub App under Settings, Developer settings, GitHub Apps. The name is up to 34 characters and unique across GitHub. You can add up to 10 callback URLs. You choose whether the app installs only on your account or on any account. One account can own up to 100 GitHub Apps.
Registering a GitHub App
The page does not state form defaults. It tells you to deselect Expire user authorization tokens and webhook Active if you do not want them, and to select Enable Device Flow if you do, which implies tokens expire and webhooks are on by default and device flow is off.
sourced · official docs · 2026-10-28
probed
Developer portal: the new GitHub App form at github.com/settings/apps/new exists and needs a signed-in GitHub account.
New GitHub App (developer portal)
HTTP 302 to https://github.com/login?return_to=https://github.com/settings/apps/new
probed · probe · 2026-10-28
Choose minimal permissionsYou10 min
Set Metadata, Contents, Issues, and Pull requests to read. Add write only where the agent acts.
sourced
Repository admins can install a third-party GitHub App in their org only if it requests no organization permissions and not Repository administration. Members and outside collaborators can request an install, and owners get notified. Installers choose all repositories or selected ones. Owners can block repo admins from installing apps, and then only an owner can install.
Installing a GitHub App from a third party
sourced · official docs · 2026-10-28
sourced
GitHub Apps let you ask for read-only contents access instead of the write access the repo scope grants. Actions taken with a user token are labeled as the app acting for the user.
Deciding when to build a GitHub App
sourced · official docs · 2026-10-28
Generate secret and private keyYou5 min
Click Generate a new client secret and Generate a private key. Store both in a secret manager.
sourced
Installing a GitHub App on an organization needs an organization owner or admin permission on a repository. Installation tokens expire after about one hour and act as a bot.
Differences between GitHub Apps and OAuth apps
sourced · official docs · 2026-10-28
sourced
A GitHub App user access token only has permissions that both the user and the app have. User tokens come from the web flow (PKCE S256 supported), device flow, or authorization during install, and expire after 8 hours with a 6 month refresh token.
Generating a user access token for a GitHub App
sourced · official docs · 2026-10-28
Build sign-in with PKCEAgent1 to 2 hours
Redirect to https://github.com/login/oauth/authorize with client_id, redirect_uri, state, and an S256 code_challenge. Exchange the code with the code_verifier. Refresh before the 8-hour expiry.
https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-user-access-token-for-a-github-app
sourced
OAuth apps support PKCE with code_challenge_method S256 only. GitHub strongly recommends it but does not require it.
Authorizing OAuth apps
sourced · official docs · 2026-10-28
sourced
Expiring user tokens last 8 hours and come with a refresh token that lasts 6 months. A refresh returns a new pair and the old refresh and access tokens stop working. Scopes cannot change on refresh.
Authorizing OAuth apps
sourced · official docs · 2026-10-28
sourced
A GitHub App user access token only has permissions that both the user and the app have. User tokens come from the web flow (PKCE S256 supported), device flow, or authorization during install, and expire after 8 hours with a 6 month refresh token.
Generating a user access token for a GitHub App
sourced · official docs · 2026-10-28
probed
The authorize endpoint is live. A signed-out request with an invalid client ID is redirected to the GitHub sign-in page, so the client ID is not checked before sign-in.
GitHub authorize endpoint
HTTP 302 to https://github.com/login?client_id=oauth-guide-probe-invalid&return_to=/login/oauth/authorize...
probed · probe · 2026-10-28
Install and testYou15 min
Click Install App and choose selected repositories. Call GET /user/installations to confirm the token sees them.
sourced
A GitHub App user access token only has permissions that both the user and the app have. User tokens come from the web flow (PKCE S256 supported), device flow, or authorization during install, and expire after 8 hours with a 6 month refresh token.
Generating a user access token for a GitHub App
sourced · official docs · 2026-10-28
sourced
Repository admins can install a third-party GitHub App in their org only if it requests no organization permissions and not Repository administration. Members and outside collaborators can request an install, and owners get notified. Installers choose all repositories or selected ones. Owners can block repo admins from installing apps, and then only an owner can install.
Installing a GitHub App from a third party
sourced · official docs · 2026-10-28

Limited beta

Make the app publicYou5 min
In Advanced, make the app public. GitHub does not review this.
https://docs.github.com/en/apps/creating-github-apps/setting-up-a-github-app/making-a-github-app-public-or-private
sourced
A public GitHub App can be installed and authorized by any GitHub user and can be listed on Marketplace. A private one installs only on the owning account, and only members of the owning org can authorize it.
Making a GitHub App public or private
sourced · official docs · 2026-10-28
Handle install in onboardingAgent1 to 3 hours
Call GET /user/installations after sign-in. If the org has no install, link to your install page or show the owner draft.
sourced
A GitHub App user access token only has permissions that both the user and the app have. User tokens come from the web flow (PKCE S256 supported), device flow, or authorization during install, and expire after 8 hours with a 6 month refresh token.
Generating a user access token for a GitHub App
sourced · official docs · 2026-10-28
sourced
Repository admins can install a third-party GitHub App in their org only if it requests no organization permissions and not Repository administration. Members and outside collaborators can request an install, and owners get notified. Installers choose all repositories or selected ones. Owners can block repo admins from installing apps, and then only an owner can install.
Installing a GitHub App from a third party
sourced · official docs · 2026-10-28
sourced
App access requests are enabled by default in organizations, so members and outside collaborators can request unapproved apps. Blocking requests from members is in public preview. If an owner both blocks requests and stops repo admins from installing apps, repo admins can neither install nor request.
Limiting OAuth app and GitHub App access requests
sourced · official docs · 2026-10-28
Wait for org ownersProvider (wait)minutes to weeks, per customer
Members and outside collaborators can request an install. The org owner decides. You cannot speed this up. Send the owner the draft message.
sourced
Repository admins can install a third-party GitHub App in their org only if it requests no organization permissions and not Repository administration. Members and outside collaborators can request an install, and owners get notified. Installers choose all repositories or selected ones. Owners can block repo admins from installing apps, and then only an owner can install.
Installing a GitHub App from a third party
sourced · official docs · 2026-10-28
inferred
How long an org owner takes to approve or install your app depends on each customer. GitHub gives no timeline, so the wait can range from minutes to never.
Owner approval is a customer decision (e10, e14, e15). No source gives a duration.
inferred · reasoning · 2026-10-28
Plan for rate limitsAgent1 to 2 hours
User tokens share 5,000 requests per hour across the user's apps. Installation tokens get up to 12,500, or 15,000 on Enterprise Cloud. Keep content creation under about 80 per minute.
sourced
User tokens (personal tokens, OAuth app tokens, GitHub App user tokens) share 5,000 REST requests per hour per user. Installation tokens start at 5,000 and grow with repos and users up to 12,500, or 15,000 on Enterprise Cloud orgs.
Rate limits for the REST API
sourced · official docs · 2026-10-28
sourced
Secondary limits apply to all tokens: at most 100 concurrent requests, about 80 content-creating requests per minute and 500 per hour, and 2,000 OAuth token requests per hour per app.
Rate limits for the REST API
sourced · official docs · 2026-10-28

Production

Publish privacy and support pagesYou1 to 3 hours
Link both from the app description.
sourced
Marketplace listings need a valid privacy policy link, a support link or email, value beyond authentication, a publicly available app, Marketplace webhook events, and acceptance of the Marketplace Developer Agreement. Paid listings need 100 installs for a GitHub App or 200 users for an OAuth app. No review timeline is given.
Requirements for listing an app
sourced · official docs · 2026-10-28
Optional: list on MarketplaceYou1 to 3 hours
Add description, logo, screenshots, pricing (free works), and privacy and support links. Click Request publish. Paid plans need a verified publisher org and 100 installs.
https://docs.github.com/en/apps/github-marketplace/creating-apps-for-github-marketplace/requirements-for-listing-an-app
sourced
Anyone can list a free app on GitHub Marketplace. Only organization-owned apps whose org has completed publisher verification can sell paid plans.
About GitHub Marketplace for apps
sourced · official docs · 2026-10-28
sourced
Marketplace listings need a valid privacy policy link, a support link or email, value beyond authentication, a publicly available app, Marketplace webhook events, and acceptance of the Marketplace Developer Agreement. Paid listings need 100 installs for a GitHub App or 200 users for an OAuth app. No review timeline is given.
Requirements for listing an app
sourced · official docs · 2026-10-28
sourced
When you request publication of a Marketplace listing, GitHub sends it for review and an onboarding expert contacts you. No timeline is given.
Submitting your listing for publication
sourced · official docs · 2026-10-28
Wait for Marketplace decisionProvider (wait)unknown
Only if you listed. An onboarding expert contacts you. No stated timeline.
sourced
Marketplace listings need a valid privacy policy link, a support link or email, value beyond authentication, a publicly available app, Marketplace webhook events, and acceptance of the Marketplace Developer Agreement. Paid listings need 100 installs for a GitHub App or 200 users for an OAuth app. No review timeline is given.
Requirements for listing an app
sourced · official docs · 2026-10-28
sourced
When you request publication of a Marketplace listing, GitHub sends it for review and an onboarding expert contacts you. No timeline is given.
Submitting your listing for publication
sourced · official docs · 2026-10-28

Blockers

Org users see Request instead of Install, or your agent sees no org repos.
Cause: Org permissions or Repository administration block repo admin installs.
Fix: Drop those permissions, or send the owner the approval draft.
Help: The customer's org owner.
sourced
Repository admins can install a third-party GitHub App in their org only if it requests no organization permissions and not Repository administration. Members and outside collaborators can request an install, and owners get notified. Installers choose all repositories or selected ones. Owners can block repo admins from installing apps, and then only an owner can install.
Installing a GitHub App from a third party
sourced · official docs · 2026-10-28
An OAuth app works for personal repos but not org repos.
Cause: OAuth app access restrictions are on by default in new orgs.
Fix: Ask the user to request owner approval, or switch to a GitHub App, which is exempt.
Help: The customer's org owner.
sourced
GitHub Apps are not subject to organization application policies. When a policy is active, OAuth app access to the organization needs an owner's approval.
Differences between GitHub Apps and OAuth apps
sourced · official docs · 2026-10-28
sourced
OAuth app access restrictions are enabled by default when you create a new organization. Members must then ask an owner to approve an OAuth app before it can reach organization resources.
About OAuth app access restrictions
Quote: "When you create a new organization, OAuth app access restrictions are enabled by default." The page gives no start date.
sourced · official docs · 2026-10-28
The callback receives error=redirect_uri_mismatch.
Cause: The redirect_uri does not match a registered callback URL.
Fix: Register the exact URL (up to 10), or omit redirect_uri to use the first.
sourced
With wildcard matching off, redirect_uri must match a callback URL exactly. For loopback redirects the port may differ, and GitHub recommends 127.0.0.1 or ::1 over localhost.
Authorizing OAuth apps
sourced · official docs · 2026-10-28
sourced
You register a GitHub App under Settings, Developer settings, GitHub Apps. The name is up to 34 characters and unique across GitHub. You can add up to 10 callback URLs. You choose whether the app installs only on your account or on any account. One account can own up to 100 GitHub Apps.
Registering a GitHub App
The page does not state form defaults. It tells you to deselect Expire user authorization tokens and webhook Active if you do not want them, and to select Enable Device Flow if you do, which implies tokens expire and webhooks are on by default and device flow is off.
sourced · official docs · 2026-10-28
sourced
Authorization errors come back to your callback as error=application_suspended (contact GitHub Support), error=redirect_uri_mismatch, or error=access_denied.
Troubleshooting authorization request errors
sourced · official docs · 2026-10-28
Refresh fails with bad_refresh_token, or users are logged out.
Cause: Refresh tokens rotate and break if reused or unused for 6 months.
Fix: Save each new refresh token atomically; on failure, re-run sign-in.
sourced
Expiring user tokens last 8 hours and come with a refresh token that lasts 6 months. A refresh returns a new pair and the old refresh and access tokens stop working. Scopes cannot change on refresh.
Authorizing OAuth apps
sourced · official docs · 2026-10-28
Stored tokens stop working after users reconnect many times.
Cause: GitHub keeps at most 10 tokens per user, app, and scope, revoking the least recently used.
Fix: Reuse one stored token per user.
sourced
GitHub keeps at most 10 tokens per user, app, and scope combination. Creating an 11th revokes one by a set order: never-used tokens first, then the least recently used. Token creation is also limited to 10 per hour per combination; past that, GitHub asks the user to re-authorize instead of revoking.
Authorizing OAuth apps
sourced · official docs · 2026-10-28
403 or 429 responses with rate limit headers.
Cause: User tokens share 5,000 requests per hour, and secondary limits cap bursts.
Fix: Move bulk reads to installation tokens, honor retry-after, and slow write bursts.
sourced
User tokens (personal tokens, OAuth app tokens, GitHub App user tokens) share 5,000 REST requests per hour per user. Installation tokens start at 5,000 and grow with repos and users up to 12,500, or 15,000 on Enterprise Cloud orgs.
Rate limits for the REST API
sourced · official docs · 2026-10-28
sourced
Secondary limits apply to all tokens: at most 100 concurrent requests, about 80 content-creating requests per minute and 500 per hour, and 2,000 OAuth token requests per hour per app.
Rate limits for the REST API
sourced · official docs · 2026-10-28
The callback receives error=application_suspended.
Cause: GitHub suspended the app for abuse, spam, or API misuse.
Fix: Check recent traffic for misuse and contact GitHub.
Help: GitHub Support portal: https://support.github.com
sourced
Authorization errors come back to your callback as error=application_suspended (contact GitHub Support), error=redirect_uri_mismatch, or error=access_denied.
Troubleshooting authorization request errors
sourced · official docs · 2026-10-28
Authorization codes arrive at unexpected subdomains or paths.
Cause: Apps with one callback URL from before Aug 3, 2026 have wildcard redirect matching on by default.
Fix: Turn wildcard matching off on each callback URL unless you need it.
sourced
On Aug 14, 2026 GitHub let OAuth apps register up to 10 redirect URIs and use expiring tokens with refresh tokens, on by default for new apps or through the offline_access scope. It also made wildcard redirect matching visible and configurable per URI for OAuth apps and GitHub Apps.
Changelog: multiple redirect URIs and token refresh for OAuth apps (Aug 14, 2026)
sourced · official forum or blog · 2026-10-28
sourced
Wildcard matching is set per callback URL. When on, any subdomain or subdirectory is accepted but the base host and port must match. Apps with a single callback URL from before Aug 3, 2026 have it on by default, and GitHub suggests turning it off if you do not need it.
About the user authorization callback URL
sourced · official docs · 2026-10-28

Agent and you

Agent did

Read about 19 official GitHub and Composio pages and cited each claim.
Probed the authorize endpoint with an invalid client ID. It is live and requires sign-in.
Checked github.com/settings/apps/new. It exists and needs sign-in.
Drafted an org owner request, a Marketplace description, and a permission rationale.

Agent can do

Write PKCE sign-in, token storage, and refresh rotation.
Write the install check and redirect in onboarding.
Pick minimal permissions for your agent's actions.
Fill the GitHub App form in a browser after you sign in.
Draft privacy policy outline and Marketplace text.

You must do

Sign in to GitHub and pass 2FA.
Create the app, client secret, and private key.
Choose the owning account (personal or org).
Publish a privacy policy and support contact.
Accept the Marketplace Developer Agreement if you list.
Work with customer org owners on installs.

Drafts

Org owner install request draft · other

Hi <owner name>,

I want to use <App name> on our <org name> repositories. An owner must install it.

Access:
- Only repositories you select (for example <repo names>).
- Read: code, issues, pull requests, metadata.
- Write: issues and pull requests. It never pushes to protected branches.
- No organization permissions or repository administration.

Why: <one sentence on the task, for example "it triages new issues and opens fix PRs for us to review">.

Remove it any time under Organization settings, GitHub Apps. Install link: <https://github.com/apps/your-app/installations/new>
Privacy policy: <url>

Thanks,
<your name>

Marketplace listing description draft · app description

<App name> is a coding agent for repositories you choose. It reads code, issues, and pull requests, and proposes changes as pull requests.

What you control:
- Which repositories it sees.
- Minimal permissions: read code, read and write issues and pull requests.
- Nothing merges without a person.

Getting started: install, pick repositories, and sign in at <your site>.

Support: <support email or URL>. Privacy policy: <url>.

Permission rationale draft · scope justification

Metadata (read): required; lists visible repositories.
Contents (read): reads code to plan changes.
Contents (write): only to push PR branches.
Issues (read and write): reads, opens, and comments on issues.
Pull requests (read and write): opens PRs and replies to reviews.
Not requested: organization permissions, Repository administration, Workflows, so repo admins can install.

- GitHub data read (code, issues, pull requests) and why.
- Which AI provider receives code, and whether it trains on it.
- Retention and deletion of code, tokens, and logs.
- How to revoke access and what happens to data.
- Storage location and who has access.
- Privacy contact email.

Open questions

How long does Marketplace listing review take?
GitHub says an onboarding expert contacts you but gives no timeline.
To resolve: Submit a free listing and record the dates, or ask GitHub Support.
Do enterprise policies change OAuth app restrictions or block GitHub App installs across an enterprise?
The pages read cover org-level controls only.
To resolve: Read the Enterprise Cloud app policy docs, or ask an enterprise admin.
How long do org owners take to approve installs?
It varies by customer and no source gives a duration.
To resolve: Track request-to-install time across beta customers.
What does a signed-in user see for an invalid client ID?
The signed-out probe hit the sign-in page before the client ID check.
To resolve: Open the probe URL while signed in during setup and note the error.

Sources

Differences between GitHub Apps and OAuth apps official docs · 2026-10-28
Authorizing OAuth apps official docs · 2026-10-28
About OAuth app access restrictions official docs · 2026-10-28
Generating a user access token for a GitHub App official docs · 2026-10-28
Registering a GitHub App official docs · 2026-10-28
Making a GitHub App public or private official docs · 2026-10-28
Installing a GitHub App from a third party official docs · 2026-10-28
Limiting OAuth app and GitHub App access requests official docs · 2026-10-28
Rate limits for the REST API official docs · 2026-10-28
About GitHub Marketplace for apps official docs · 2026-10-28
Requirements for listing an app official docs · 2026-10-28
Scopes for OAuth apps official docs · 2026-10-28
Changelog: multiple redirect URIs and token refresh for OAuth apps (Aug 14, 2026) official forum or blog · 2026-10-28
About the user authorization callback URL official docs · 2026-10-28
Troubleshooting authorization request errors official docs · 2026-10-28
Deciding when to build a GitHub App official docs · 2026-10-28
Composio managed auth composio docs · 2026-10-28
Custom app vs managed app composio docs · 2026-10-28
White-labeling authentication composio docs · 2026-10-28
GitHub authorize endpoint probe · 2026-10-28
New GitHub App (developer portal) probe · 2026-10-28
Submitting your listing for publication official docs · 2026-10-28
Installing a GitHub App from GitHub Marketplace for your organizations official docs · 2026-10-28
Composio GitHub toolkit composio docs · 2026-10-28

Verification changes

Marketplace listing now described as reviewed by GitHub: after Request publish, an onboarding expert contacts you. Updated verdict summary, production notes, s11, s12.
The guide said only that you submit the listing. GitHub's submission page says the listing is sent for review. 2026-10-28
Corrected e15: blocking access requests alone does not stop repo admins from installing apps. That needs a separate member privilege setting.
The access requests page treats repo admin installs as a separate setting and says both must be off to block repo admins. 2026-10-28
Customer-side gate note and e14 now say owners can block repo admins from installing apps.
Both install pages say owners can turn off repo admin installs, which makes the owner the only path. 2026-10-28
Narrowed e12: the registration page implies, but does not state, the form defaults for expiring tokens, webhooks, and device flow. Moved this to the note.
The page gives instructions to deselect or select these boxes, not their defaults. 2026-10-28
Narrowed the token cap blocker and e9: GitHub revokes unused or least recently used tokens, not simply the oldest.
The authorizing page gives an eviction order, and the hourly cap triggers a re-authorization prompt rather than revocation. 2026-10-28
Composio note now says a bring-your-own GitHub App works, but you must send users to the install page yourself.
Composio's GitHub toolkit page says it does not provide the install link. 2026-10-28
Added the 15,000 per hour Enterprise Cloud installation limit to s9.
The rate limit page gives it, and e16 already cited it. 2026-10-28
Composio note: replaced "Switching only affects new connections; existing users keep the old connection until they reconnect." with the switching rule as Composio states it, including importing credentials.
A reviewer cross-checked Composio's docs: existing users stay on the old connection until they re-authenticate or you import their credentials, so "must reconnect" overstated it. 2026-10-28