| \nBrowsers\n | \n\n⚠️ `@octokit/auth-oauth-app` is not meant for usage in the browser. The OAuth APIs to create tokens do not have CORS enabled, and a client secret must not be exposed to the client.\n\nIf you know what you are doing, load `@octokit/auth-oauth-app` directly from [esm.sh](https://esm.sh)\n\n```html\n\n```\n\n |
|---|---|
| \nNode\n | \n\nInstall with npm install @octokit/auth-oauth-app\n\n```js\nimport { createOAuthAppAuth } from \"@octokit/auth-oauth-app\";\n```\n\n |
| \n\nBrowsers\n\n | \n\n⚠️ `@octokit/auth-oauth-app` is not meant for usage in the browser. The OAuth APIs to create tokens do not have CORS enabled, and a client secret must not be exposed to the client.\n\nIf you know what you are doing, load `@octokit/auth-oauth-app` and `@octokit/core` (or a compatible module) directly from [esm.sh](https://esm.sh)\n\n```html\n\n```\n\n |
|---|---|
| \n\nNode\n\n | \n\nInstall with `npm install @octokit/core @octokit/auth-oauth-app`. Optionally replace `@octokit/core` with a compatible module\n\n```js\nimport { Octokit } from \"@octokit/core\";\nimport {\n createOAuthAppAuth,\n createOAuthUserAuth,\n} from \"@octokit/auth-oauth-app\";\n```\n\n |
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n clientId\n | \n \n string\n | \n \n Required. Find your OAuth app’s Client ID in your account’s developer settings.\n | \n
\n clientSecret\n | \n \n string\n | \n \n Required. Find your OAuth app’s Client Secret in your account’s developer settings.\n | \n
\n clientType\n | \n \n string\n | \n \n Must be set to either \"oauth-app\" or \"github-app\". Defaults to \"oauth-app\"\n | \n
\n request\n | \n \n function\n | \n \n You can pass in your own @octokit/request instance. For usage with enterprise, set baseUrl to the API root endpoint. Example:\n\n```js\nimport { request } from \"@octokit/request\";\ncreateOAuthAppAuth({\n clientId: \"1234567890abcdef1234\",\n clientSecret: \"1234567890abcdef1234567890abcdef12345678\",\n request: request.defaults({\n baseUrl: \"https://ghe.my-company.com/api/v3\",\n }),\n});\n```\n\n |
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n type\n | \n \n string\n | \n \n Required. Must be set to \"oauth-app\"\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n type\n | \n \n string\n | \n \n Required. Must be set to \"oauth-user\".\n | \n
\n code\n | \n \n string\n | \n \n Required. The authorization code which was passed as query parameter to the callback URL from the OAuth web application flow.\n | \n
\n redirectUrl\n | \n \n string\n | \n \n The URL in your application where users are sent after authorization. See redirect urls.\n | \n
\n state\n | \n \n string\n | \n \n The unguessable random string you provided in Step 1 of the OAuth web application flow.\n | \n
\n factory\n | \n \n function\n | \n \n\nWhen the `factory` option is, the `auth({type: \"oauth-user\", code, factory })` call with resolve with whatever the `factory` function returns. The `factory` function will be called with all the strategy option that `auth` was created with, plus the additional options passed to `auth`, besides `type` and `factory`.\n\nFor example, you can create a new `auth` instance for a user using [`createOAuthUserAuth`](https://github.com/octokit/auth-oauth-user.js/#readme) which implements auto-refreshing tokens, among other features. You can import `createOAuthUserAuth` directly from `@octokit/auth-oauth-app` which will ensure compatibility.\n\n```js\nimport {\n createOAuthAppAuth,\n createOAuthUserAuth,\n} from \"@octokit/auth-oauth-app\";\n\nconst appAuth = createOAuthAppAuth({\n clientType: \"github-app\",\n clientId: \"lv1.1234567890abcdef\",\n clientSecret: \"1234567890abcdef1234567890abcdef12345678\",\n});\n\nconst userAuth = await appAuth({\n type: \"oauth-user\",\n code,\n factory: createOAuthUserAuth,\n});\n\n// will create token upon first call, then cache authentication for successive calls,\n// until token needs to be refreshed (if enabled for the GitHub App)\nconst authentication = await userAuth();\n```\n\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n type\n | \n \n string\n | \n \n Required. Must be set to \"oauth-user\".\n | \n
\n onVerification\n | \n \n function\n | \n \n\n**Required**. A function that is called once the device and user codes were retrieved.\n\nThe `onVerification()` callback can be used to pause until the user completes step 2, which might result in a better user experience.\n\n```js\nconst auth = auth({\n type: \"oauth-user\",\n async onVerification(verification) {\n console.log(\"Open %s\", verification.verification_uri);\n console.log(\"Enter code: %s\", verification.user_code);\n\n await prompt(\"press enter when you are ready to continue\");\n },\n});\n```\n\n | \n
\n scopes\n | \n \n array of strings\n | \n \n Only relevant if the clientType strategy option is set to \"oauth-app\".Array of OAuth scope names that the user access token should be granted. Defaults to no scopes ([]).\n | \n
\n factory\n | \n \n function\n | \n \n\nWhen the `factory` option is, the `auth({type: \"oauth-user\", code, factory })` call with resolve with whatever the `factory` function returns. The `factory` function will be called with all the strategy option that `auth` was created with, plus the additional options passed to `auth`, besides `type` and `factory`.\n\nFor example, you can create a new `auth` instance for a user using [`createOAuthUserAuth`](https://github.com/octokit/auth-oauth-user.js/#readme) which implements auto-refreshing tokens, among other features. You can import `createOAuthUserAuth` directly from `@octokit/auth-oauth-app` which will ensure compatibility.\n\n```js\nimport {\n createOAuthAppAuth,\n createOAuthUserAuth,\n} from \"@octokit/auth-oauth-app\";\n\nconst appAuth = createOAuthAppAuth({\n clientType: \"github-app\",\n clientId: \"lv1.1234567890abcdef\",\n clientSecret: \"1234567890abcdef1234567890abcdef12345678\",\n});\n\nconst userAuth = await appAuth({\n type: \"oauth-user\",\n onVerification,\n factory: createOAuthUserAuth,\n});\n\n// will create token upon first call, then cache authentication for successive calls,\n// until token needs to be refreshed (if enabled for the GitHub App)\nconst authentication = await userAuth();\n```\n\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n type\n | \n \n string\n | \n \n \"oauth-app\"\n | \n
\n clientType\n | \n \n string\n | \n \n \"oauth-app\" or \"github-app\"\n | \n
\n clientId\n | \n \n string\n | \n \n The client ID as passed to the constructor.\n | \n
\n clientSecret\n | \n \n string\n | \n \n The client secret as passed to the constructor.\n | \n
\n headers\n | \n \n object\n | \n \n { authorization }.\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n type\n | \n \n string\n | \n \n \"token\"\n | \n
\n tokenType\n | \n \n string\n | \n \n \"oauth\"\n | \n
\n clientType\n | \n \n string\n | \n \n \"oauth-app\"\n | \n
\n clientId\n | \n \n string\n | \n \n The clientId from the strategy options\n | \n
\n clientSecret\n | \n \n string\n | \n \n The clientSecret from the strategy options\n | \n
\n token\n | \n \n string\n | \n \n The user access token\n | \n
\n scopes\n | \n \n array of strings\n | \n \n array of scope names enabled for the token\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n type\n | \n \n string\n | \n \n \"token\"\n | \n
\n tokenType\n | \n \n string\n | \n \n \"oauth\"\n | \n
\n clientType\n | \n \n string\n | \n \n \"github-app\"\n | \n
\n clientId\n | \n \n string\n | \n \n The app's Client ID\n | \n
\n clientSecret\n | \n \n string\n | \n \n One of the app's client secrets\n | \n
\n token\n | \n \n string\n | \n \n The user access token\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n type\n | \n \n string\n | \n \n \"token\"\n | \n
\n tokenType\n | \n \n string\n | \n \n \"oauth\"\n | \n
\n clientType\n | \n \n string\n | \n \n \"github-app\"\n | \n
\n clientId\n | \n \n string\n | \n \n The app's Client ID\n | \n
\n clientSecret\n | \n \n string\n | \n \n One of the app's client secrets\n | \n
\n token\n | \n \n string\n | \n \n The user access token\n | \n
\n refreshToken\n | \n \n string\n | \n \n The refresh token\n | \n
\n expiresAt\n | \n \n string\n | \n \n Date timestamp in ISO 8601 standard. Example: 2022-01-01T08:00:0.000Z\n | \n
\n refreshTokenExpiresAt\n | \n \n string\n | \n \n Date timestamp in ISO 8601 standard. Example: 2021-07-01T00:00:0.000Z\n | \n