HTTP/2 301
access-control-allow-origin: *
content-security-policy: default-src 'none';prefetch-src 'self';connect-src 'self';font-src 'self' data:;img-src 'self' github.com *.github.com *.githubusercontent.com *.githubassets.com data: placehold.it;object-src 'self';script-src 'self' github.com *.github.com *.githubusercontent.com *.githubassets.com 'self' data:;script-src-attr 'self';frame-src 'self' github.com *.github.com *.githubusercontent.com *.githubassets.com https://support.github.com https://www.youtube-nocookie.com;frame-ancestors 'self' github.com *.github.com *.githubusercontent.com *.githubassets.com;style-src 'self' github.com *.github.com *.githubusercontent.com *.githubassets.com 'self' 'unsafe-inline' data:;child-src 'self';manifest-src 'self';upgrade-insecure-requests;base-uri 'self';form-action 'self'
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
cache-control: public, max-age=60
location: /en/apps/oauth-apps/building-oauth-apps
content-type: text/plain; charset=utf-8
x-github-backend: Kubernetes
x-github-request-id: D31C:241E94:5D9E3F:915ACB:687B322D
accept-ranges: bytes
age: 0
date: Sat, 19 Jul 2025 05:50:37 GMT
via: 1.1 varnish
x-served-by: cache-bom4749-BOM
x-cache: MISS
x-cache-hits: 0
x-timer: S1752904237.847790,VS0,VE984
vary: Accept
strict-transport-security: max-age=31557600
content-length: 73
HTTP/2 200
access-control-allow-origin: *
content-security-policy: default-src 'none';prefetch-src 'self';connect-src 'self';font-src 'self' data:;img-src 'self' github.com *.github.com *.githubusercontent.com *.githubassets.com data: placehold.it;object-src 'self';script-src 'self' github.com *.github.com *.githubusercontent.com *.githubassets.com 'self' data:;script-src-attr 'self';frame-src 'self' github.com *.github.com *.githubusercontent.com *.githubassets.com https://support.github.com https://www.youtube-nocookie.com;frame-ancestors 'self' github.com *.github.com *.githubusercontent.com *.githubassets.com;style-src 'self' github.com *.github.com *.githubusercontent.com *.githubassets.com 'self' 'unsafe-inline' data:;child-src 'self';manifest-src 'self';upgrade-insecure-requests;base-uri 'self';form-action 'self'
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
cache-control: public, max-age=60
x-powered-by: Next.js
content-type: text/html; charset=utf-8
x-github-backend: Kubernetes
x-github-request-id: 5E96:23BF23:556638:892310:687B322E
content-encoding: gzip
accept-ranges: bytes
age: 1
date: Sat, 19 Jul 2025 05:50:39 GMT
via: 1.1 varnish
x-served-by: cache-bom4749-BOM
x-cache: MISS
x-cache-hits: 0
x-timer: S1752904238.846112,VS0,VE1883
vary: Accept-Encoding
strict-transport-security: max-age=31557600
content-length: 25775
Building OAuth apps - GitHub Docs Skip to main content Overview
About creating GitHub Apps Authenticate with a GitHub App Writing code for a GitHub App List an app on the Marketplace Sell apps on the Marketplace
Building OAuth apps You can build OAuth apps for yourself or others to use. Learn how to register and set up permissions and authorization options for OAuth apps.
In general, GitHub Apps are preferred to OAuth apps because they use fine-grained permissions, give more control over which repositories the app can access, and use short-lived tokens.
Rate limits restrict the rate of traffic to GitHub.com, to help ensure consistent access for all users.
You can create and register an OAuth app under your personal account or under any organization you have administrative access to. While creating your OAuth app, remember to protect your privacy by only using information you consider public.
Learn about the different ways to authenticate with some examples.
You can enable other users to authorize your OAuth app.
Scopes let you specify exactly what type of access you need. Scopes limit access for OAuth tokens. They do not grant any additional permission beyond that which the user already has.
You can replace the default badge on your OAuth app by uploading your own logo image and customizing the background.
Follow these best practices to improve the security and performance of your OAuth app.
Help and support Ask Copilot your question. Ask Copilot