> ## Documentation Index
> Fetch the complete documentation index at: https://auth0.com/ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# GitHub

> Connect your AI Agents to GitHub for repository access, issue management, and developer workflows.

export const Auth0SetupBlock = ({providerName, clientIDName = "Client ID", clientSecretName = "Client Secret", scopesName = "Permissions", allowFreeFormScopes = false, allowOfflineAccess = false}) => {
  return <>
      <ol>
        <li>
          In the <a href="https://manage.auth0.com">Auth0 Dashboard</a>, go to{" "}
          <b>Authentication &gt; Social</b>.
        </li>
        <li>
          Select <b>Create Connection</b>, then choose <b>{providerName}</b>.
        </li>
        <li>Click <b>Continue</b>.</li>
        <li>
          In <b>General</b>:
          <ol type="A">
            <li>
              Enter the <b>{clientIDName}</b> and <b>{clientSecretName}</b> from
              your {providerName} OAuth app.
            </li>
            <li>
              Under <b>{scopesName}</b>, select the scope(s) required for your
              application. These determine what permissions your application can
              request from {providerName}, whether for authentication (such as
              accessing basic profile details) or for API access (such as
              connecting to the provider's APIs).<br /><br />For a Dropbox and Google social
              connection, you must select <b>Offline Access</b> in the Auth0 Dashboard, enabling
              the client application to obtain an Auth0 refresh token.
            </li>
            {allowOfflineAccess && <li>
                Under <b>{scopesName}</b>, enable <b>Offline Access</b> for the connection.
                This is required by Auth0 to obtain a refresh token from {providerName}.
              </li>}
            {allowFreeFormScopes && <li>
                Add any additional scopes your application requires in the{" "}
                <b>Additional Scopes</b> field.
              </li>}
          </ol>
        </li>
        <li>
          In <b>Purpose</b>, toggle on <b>Connected Accounts for Token Vault</b>. This lets the
          connection retrieve and securely store access tokens for external
          APIs. Learn more in{" "}
          <a href="https://auth0.com/docs/secure/tokens/token-vault/connected-accounts-for-token-vault">
            Connected Accounts for Token Vault
          </a>.
        </li>
        <li>Click <b>Create</b>.</li>
        <li>
          After creation, you are redirected to the <b>Applications</b> page.
          Select the application(s) to enable this connection for.
          <br />
          Note: In a new Auth0 tenant, you can select the <b>Default App</b>.
        </li>
        <li>
          Once you have created your {providerName} social connection, <a href="https://auth0.com/docs/authenticate/identity-providers/test-connections">test your connection</a> to ensure the setup is working correctly before using it in your application.
        </li>
      </ol>
    </>;
};

export const IntegrationInfoBlock = ({providerName}) => {
  return <Note>
      This guide walks you through setting up the <strong>{providerName}</strong> connection in Auth0. 
      For an end-to-end example that shows how to set up your app to call third-party APIs on the user's behalf 
      using a connection like this, read the{' '}
      <a href="/ai/docs/get-started/call-others-apis-on-users-behalf">
        Call Other's APIs on User's Behalf Quickstart
      </a>.
    </Note>;
};

Connect your AI Agents to GitHub for repository access, issue management, and developer workflows.

## Connect GitHub to Auth0

<Warning>
  <strong>GitHub app permissions</strong>

  GitHub apps [use fine grained permissions](https://docs.github.com/en/enterprise-server@3.17/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps#requesting-permission-levels-for-resources) and hence requesting permissions when configuring Token Vault is not supported. Instead, you should set the required permissions when creating the GitHub app in the GitHub developer settings.
</Warning>

<Steps>
  <Step title="GitHub Setup">
    <ol>
      <li>
        Sign up for a [GitHub Developer account](https://github.com/signup)
      </li>

      <li>
        Set up a new GitHub app via [GitHub Developer Settings > GitHub
        Apps](https://github.com/settings/apps/new)
      </li>

      <li>
        Use the following settings when configuring your GitHub app:

        <ul>
          <li>Homepage URL: `https://YOUR_AUTH0_DOMAIN`</li>
          <li>Callback URL: `https://YOUR_AUTH0_DOMAIN/login/callback`</li>
          <li>Webhook Active: Disabled</li>
          <li>Permissions: Select the appropriate permissions for your app</li>
        </ul>

        <Info>
          You can find the **Auth0 domain** in the [Auth0 Dashboard](https://manage.auth0.com/).

          You can find this under **Applications > \[Your Application] > Settings > Basic Information > Domain**.

          If you are using the [custom domains](https://auth0.com/docs/custom-domains) feature, your Auth0 domain is the custom domain. You can find this under **Branding > Custom Domains**.
        </Info>
      </li>

      <li>
        Create the app and generate a new client secret in the app settings page
        that appears.
      </li>

      <li>Note your **Client ID** and **Client Secret**</li>
    </ol>
  </Step>

  <Step title="Configure the GitHub Social Connection in Auth0">
    <ol>
      <li>
        In the [Auth0 Dashboard](https://manage.auth0.com/), navigate to
        **Authentication > Social**. Select **Create Connection** and then
        **GitHub**. Click **Continue**.
      </li>

      <li>
        In **General**, enter the **Client ID** and **Client Secret** from the
        GitHub OAuth app you created.
      </li>

      <li>
        In **Purpose**, toggle on **Connected Accounts for Token Vault**. This allows the
        connection to retrieve and securely store access tokens for external APIs. To learn more, read [Connected Accounts for Token
        Vault](https://auth0.com/docs/secure/tokens/token-vault/connected-accounts-for-token-vault).
      </li>

      <li>Click **Create**.</li>

      <li>
        After saving, go the **Applications** tab and select the applications
        that should use this connection.
      </li>
    </ol>
  </Step>
</Steps>

<Callout icon="file-lines" color="#0EA5E9" iconType="regular">
  If your application uses [Organizations](https://auth0.com/docs/manage-users/organizations), authenticate the user with the target organization before initiating the Connected Accounts flow. Token Vault still stores the GitHub connected account on the user's Auth0 profile, so each organization member authorizes their own GitHub account.
</Callout>

<IntegrationInfoBlock providerName="GitHub" />

## Token Vault configuration Example

To configure the Token Vault for your GitHub connection, you can use the following code snippet in your application:

<Tabs>
  <Tab title="JavaScript" icon="js">
    ```tsx wrap lines theme={null}
    const auth0AI = new Auth0AI();

    export const withGitHubConnection = auth0AI.withTokenVault({
      connection: "github",
      // scopes are not supported for GitHub yet. Set required scopes when creating the accompanying GitHub app
      scopes: [],
      refreshToken: getAuth0RefreshToken(),
    });
    ```
  </Tab>

  <Tab title="Python" icon="python">
    ```python wrap lines theme={null}
    auth0_ai = Auth0AI()

    with_github_connection = auth0_ai.with_token_vault(
        connection="github",
        # scopes are not supported for GitHub yet. Set required scopes when creating the accompanying GitHub app
        scopes=[],
        refresh_token=get_auth0_refresh_token,
    )
    ```
  </Tab>
</Tabs>

## Next steps

* To learn how to configure applications to access Token Vault, read [Configure Token Vault](https://auth0.com/docs/secure/tokens/token-vault/configure-token-vault).
* If your application uses [Organizations](https://auth0.com/docs/manage-users/organizations), authenticate the user with the target organization before initiating the Connected Accounts flow. Connected accounts remain linked to the individual user profile.
* To learn how to get an access token to make a tool call, complete the [Call other's APIs on user's behalf Quickstart](https://auth0.com/ai/docs/get-started/call-others-apis-on-users-behalf).