Why This Matters

Auth is the highest-risk part of API integration. Wrong method, leaked token, or over-permissive scope can compromise your org. This lesson builds the auth strategy.

Concept Explained

Three auth methods: PAT (personal access token, simplest), GitHub App installation token (recommended for automation), OAuth (for apps acting on behalf of users).

How It Works

For automation: GitHub App with installation token. For personal scripts: PAT with minimal scope. For user-facing apps: OAuth. Rotate all tokens regularly.

Step-by-Step Tutorial

1. Choose method

2. For PAT

3. For GitHub App

4. For OAuth

5. Rotate

Real-World Example

A team used a PAT with admin:org scope for their CI Copilot dashboard. Token leaked in a build log. Attacker gained admin access to org. Lesson: use GitHub App with installation token, scoped to only what's needed.

Example Prompts / Commands / Code

import requests
import jwt
import time

APP_ID = 123456
PRIVATE_KEY = open('app-private-key.pem').read()
INSTALLATION_ID = 78910

# Generate JWT
payload = {
    'iat': int(time.time()),
    'exp': int(time.time()) + 600,
    'iss': APP_ID
}
jwt_token = jwt.encode(payload, PRIVATE_KEY, algorithm='RS256')

# Get installation token
r = requests.post(
    f'https://api.github.com/app/installations/{INSTALLATION_ID}/access_tokens',
    headers={
        'Authorization': f'Bearer {jwt_token}',
        'Accept': 'application/vnd.github+json'
    }
)
installation_token = r.json()['token']

# Use installation token for Copilot API
r = requests.get(f'https://api.github.com/orgs/your-org/copilot/usage',
                 headers={'Authorization': f'Bearer {installation_token}'})

Method          Use case              Scope        Rotation
------------------------------------------------------------------------
PAT             Personal scripts     Manual       Quarterly
GitHub App      Automation, CI       Auto (1hr)   Automatic
OAuth           User-facing apps    Per-user     Refresh tokens

Common Mistakes

• PAT with admin scope — over-permissive.
• Hardcoding tokens in code — leaks.
• Not rotating tokens — accumulated risk.
• Using PAT for automation — should use GitHub App.

Best Practices

• Use GitHub App for automation.
• PAT for personal scripts only, minimal scope.
• OAuth for user-facing apps.
• Store tokens in secrets manager (Vault, AWS Secrets).
• Rotate quarterly (PATs); automatic for GitHub App.

Troubleshooting

Practical Exercise

Professional Challenge

Frequently Asked Questions

Further Reading

• Authenticating to GitHub API

Official References

• Authenticating to GitHub
• REST API for Copilot

Related lessons: PR-07, PR-08