Post #3338041
2025-02-19 06:34 UTC
@andreas@mastodon.arrakis.se @healthchecks_io@fosstodon.org thanks, that would be a nice finishing touch, but I'm at the very basics currently: do I use OAuth apps or GitHub apps? How come GitHub doesn't have a guide, a tutorial, or a high-level design doc on how to implement a secure onboarding flow? Perhaps the API is not designed for what I'm trying to do? And how other people solved this? Stuff like that 🙂
Replies (1)
-
@andreas@mastodon.arrakis.se 2025-02-19 07:35
@cuu508@toot.lv @healthchecks_io@fosstodon.org All good questions regarding the whole onboarding thing, to which I sadly don't have any good answer. What I can tell you is that you definitely want to go with GitHub Apps rather than OAuth Apps. Those OAuth Apps uses the old scary permission scope where permission to create issues requires the full "repo" scope, allowing most form of repo write access. Also, an OAuth App (kind of) gets access to all the repositories the approving user has access to.