PAT vs oAuth vs GitHub App

[Malix-Labs]

Select Topic Area

Product Feedback + Question

Body

Hello folks,

Two things:

• Could this doc page and this other doc page be merged?
  I find that having duplicate make things harder
• Neither of those two doc pages adresses that concern: which application (PAT vs oAuth vs GitHub App) requires a server for public apps (compared to running client-side only)

Thanks and have a great day guys <3

[skedwards88]

You should almost always choose a GitHub App over an OAuth app. If you are building an integration/script that is long-lived or is for an organization (as opposed to just doing some quick one-off scripting for personal use), you should choose a GitHub App over a PAT..

Whether your application requires a server depends on your application. If you are listening for webhook events, you'll probably need a server. But, a server isn't required for many other cases. For example, here's an example using a GitHub App for automation in an Actions workflow, and here's an example using a GitHub App to build a CLI (neither of which require a server despite using a GitHub App).

[Malix-Labs]

I think as long as you take care to keep your app's credentials safe, you should be able to use a GitHub App here. (If you are able to secure your PAT for use by the extension, you can probably do the same for a GitHub App).

I meant, would that be suitable (client-side only) for a public app ?

Most of the extension stores PAT in plaintext, so each users can create a PAT for themselves.

[skedwards88]

Should I simply enable every permissions scope for my GitHub Apps to allow listening to user notification, then?

Enabling every permission is generally not advised unless you app actually needs every permission. I'm guessing that you are using this endpoint? The docs for that endpoint state that your GitHub App needs the metadata:read and notifications:read permissions and can access the endpoint with a user access token (but not an installation access token)

[skedwards88]

Would that not be suitable, then (at least without a server-side) ?

I'm not familiar with browser extensions, but my guess is: Probably not. You want to keep the credentials described here secure.

[Malix-Labs]

I'm not familiar with browser extensions

The "Browser Extension" exemple was just an exemple of a client-side only app
Another more general example would be a client-side only website (static without AJAX)

Can you confirm that for client-side only apps (such as exemples stated above), securing the apps credentials according to the docs would not be possible ?

If that's indeed the case :

@skedwards88's reply:

you should choose a GitHub App over a PAT.

Is not true for all cases and thus could be misleading in some case, as you should choose a PAT for public client-side apps (easier to setup for your users)

[Malix-Labs]

Moreover

@skedwards88 reply :

I see where you are coming from, but we're going to keep them separate because users should be using GitHub Apps instead (and the older "Differences between GitHub Apps and OAuth apps" doesn't convey this as clearly).

I do agree now that GitHub Apps > oAuth Apps (except for entreprise-level ressources access), but then, wouldn't it be better to make

the older "Differences between GitHub Apps and OAuth apps" doc page

Be merged into the newer "Using a GitHub App instead of an oAuth App" doc page, as it could be misleading, as you also pointed out?

By the way, those two pages don't have exactly the same information, so it should have some type of information merge instead of a pure redirect

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[Malix-Labs]

May it be reopened?