| \n\nBrowsers\n\n | \n\n`@octokit/oauth-methods` is not meant for browser usage.\n\nSome of the methods will work, but others do not have CORS headers enabled and will fail (`exchangeWebFlowCode()`, `createDeviceCode()`, `exchangeDeviceCode()`, `refreshToken()`). Also the Client Secret should not be exposed to clients as it can be used for a [Person-in-the-middle attack](https://en.wikipedia.org/wiki/Person-in-the-middle_attack).\n\n |
|---|---|
| \n\nNode\n\n | \n\nInstall with `npm install @octokit/core @octokit/oauth-methods`\n\n```js\nimport {\n exchangeWebFlowCode,\n createDeviceCode,\n exchangeDeviceCode,\n checkToken,\n refreshToken,\n scopeToken,\n resetToken,\n deleteToken,\n deleteAuthorization,\n} from \"@octokit/oauth-methods\";\n```\n\n |
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n clientId\n | \n \n string\n | \n \n Required. The client ID you received from GitHub when you registered.\n | \n
\n clientType\n | \n \n string\n | \n \n Required. Must be set to either \"oauth-app\" or \"github-app\".\n | \n
\n redirectUrl\n | \n \n string\n | \n \n The URL in your application where users will be sent after authorization. See Redirect URLs in GitHub’s Developer Guide.\n | \n
\n login\n | \n \n string\n | \n \n Suggests a specific account to use for signing in and authorizing the app.\n | \n
\n scopes\n | \n \n array of strings\n | \n \n\nOnly relevant if `clientType` is set to `\"oauth-app\"`.\n\nAn array of scope names (or: space-delimited list of scopes). If not provided, scope defaults to an empty list for users that have not authorized any scopes for the application. For users who have authorized scopes for the application, the user won't be shown the OAuth authorization page with the list of scopes. Instead, this step of the flow will automatically complete with the set of scopes the user has authorized for the application. For example, if a user has already performed the web flow twice and has authorized one token with user scope and another token with repo scope, a third web flow that does not provide a scope will receive a token with user and repo scope.\n\nDefaults to `[]`.\n\n | \n
\n state\n | \n \n string\n | \n \n An unguessable random string. It is used to protect against cross-site request forgery attacks.\n Defaults to Math.random().toString(36).substr(2).\n | \n
\n allowSignup\n | \n \n boolean\n | \n \n Whether or not unauthenticated users will be offered an option to sign up for GitHub during the OAuth flow. Use false in the case that a policy prohibits signups. Defaults to true. \n | \n
\n request\n | \n \n function\n | \n \n You can pass in your own @octokit/request instance. For usage with enterprise, set baseUrl to the REST API root endpoint. Example:\n\n```js\nimport { request } from \"@octokit/request\";\nconst { url } = getWebFlowAuthorizationUrl({\n clientType: \"oauth-app\",\n clientId: \"1234567890abcdef1234\",\n scopes: [\"repo\"],\n request: request.defaults({\n baseUrl: \"https://ghe.my-company.com/api/v3\",\n }),\n});\n```\n\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n allowSignup\n | \n \n boolean\n | \n \n Returns options.allowSignup if it was set. Defaults to true.\n | \n
\n clientType\n | \n \n string\n | \n \n Returns options.clientType\n | \n
\n clientId\n | \n \n string\n | \n \n Returns options.clientId.\n | \n
\n login\n | \n \n string\n | \n \n Returns options.login if it was set. Defaults to null.\n | \n
\n redirectUrl\n | \n \n string\n | \n \n Returns options.redirectUrl if it was set. Defaults to null.\n | \n
\n scopes\n | \n \n array of strings\n | \n \n\nOnly set if `options.clientType` is set to `\"oauth-app\"`.\n\nReturns an array of strings. Returns options.scopes if it was set and turns the string into an array if a string was passed, otherwise [].\n\n | \n
\n state\n | \n \n string\n | \n \n Returns options.state if it was set. Defaults to Math.random().toString(36).substr(2).\n | \n
\n url\n | \n \n string\n | \n \n The authorization URL\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n clientType\n | \n \n string\n | \n \n Required. Must be set to either \"oauth-app\" or \"github-app\"\n | \n
\n clientId\n | \n \n string\n | \n \n Required. Your app's client ID\n | \n
\n clientSecret\n | \n \n string\n | \n \n Required. One of your app's client secrets\n | \n
\n code\n | \n \n string\n | \n \n Required. The code from GitHub's OAuth flow redirect's ?code=... query parameter\n | \n
\n redirectUrl\n | \n \n string\n | \n \n The redirectUrl option you passed to getWebFlowAuthorizationUrl()\n | \n
\n request\n | \n \n function\n | \n \n You can pass in your own @octokit/request instance. For usage with enterprise, set baseUrl to the REST API root endpoint. Example:\n\n```js\nimport { request } from \"@octokit/request\";\nconst { data, authentication } = await exchangeWebFlowCode({\n clientType: \"oauth-app\",\n clientId: \"1234567890abcdef1234\",\n clientSecret: \"1234567890abcdef12347890abcdef12345678\",\n code: \"code123\",\n request: request.defaults({\n baseUrl: \"https://ghe.my-company.com/api/v3\",\n }),\n});\n```\n\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n clientType\n | \n \n string\n | \n \n Required. Must be set to either \"oauth-app\" or \"github-app\"\n | \n
\n clientId\n | \n \n string\n | \n \n Required. Your app's client ID\n | \n
\n scopes\n | \n \n array of strings\n | \n \n\nOnly permitted if `clientType` is set to `\"oauth-app\"`. GitHub Apps do not support scopes.\n\nArray of [scope names](https://docs.github.com/en/developers/apps/scopes-for-oauth-apps#available-scopes) you want to request for the user access token.\n\n | \n
\n request\n | \n \n function\n | \n \n You can pass in your own @octokit/request instance. For usage with enterprise, set baseUrl to the REST API root endpoint. Example:\n\n```js\nimport { request } from \"@octokit/request\";\nconst { data } = await createDeviceCode({\n clientType: \"oauth-app\",\n clientId: \"1234567890abcdef1234\",\n scopes: [\"repo\"],\n request: request.defaults({\n baseUrl: \"https://ghe.my-company.com/api/v3\",\n }),\n});\n```\n\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n clientType\n | \n \n string\n | \n \n Required. Must be set to either \"oauth-app\" or \"github-app\"\n | \n
\n clientId\n | \n \n string\n | \n \n Required. Your app's client ID\n | \n
\n code\n | \n \n string\n | \n \n Required. The device_code from the createDeviceCode() response\n | \n
\n request\n | \n \n function\n | \n \n You can pass in your own @octokit/request instance. For usage with enterprise, set baseUrl to the REST API root endpoint. Example:\n\n```js\nimport { request } from \"@octokit/request\";\nconst { data, authentication } = await exchangeDeviceCode({\n clientType: \"oauth-app\",\n clientId: \"1234567890abcdef1234\",\n code: \"code123\",\n request: request.defaults({\n baseUrl: \"https://ghe.my-company.com/api/v3\",\n }),\n});\n```\n\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n clientType\n | \n \n string\n | \n \n Required. Must be set to either \"oauth-app\" or \"github-app\"\n | \n
\n clientId\n | \n \n string\n | \n \n Required. Your app's client ID\n | \n
\n clientSecret\n | \n \n string\n | \n \n Required. One of your app's client secrets\n | \n
\n token\n | \n \n string\n | \n \n Required. The user access token to check\n | \n
\n request\n | \n \n function\n | \n \n You can pass in your own @octokit/request instance. For usage with enterprise, set baseUrl to the REST API root endpoint. Example:\n\n```js\nimport { request } from \"@octokit/request\";\nconst { data, authentication } = await checkToken({\n clientType: \"oauth-app\",\n clientId: \"1234567890abcdef1234\",\n clientSecret: \"1234567890abcdef12347890abcdef12345678\",\n token: \"usertoken123\",\n request: request.defaults({\n baseUrl: \"https://ghe.my-company.com/api/v3\",\n }),\n});\n```\n\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n clientType\n | \n \n string\n | \n \n Must be set to \"github-app\"\n | \n
\n clientId\n | \n \n string\n | \n \n Required. Your app's client ID\n | \n
\n clientSecret\n | \n \n string\n | \n \n Required. One of your app's client secrets\n | \n
\n refreshToken\n | \n \n string\n | \n \n Required. The refresh token that was received alongside the user access token.\n | \n
\n request\n | \n \n function\n | \n \n You can pass in your own @octokit/request instance. For usage with enterprise, set baseUrl to the REST API root endpoint. Example:\n\n```js\nimport { request } from \"@octokit/request\";\nconst { data, authentication } = await refreshToken({\n clientType: \"github-app\",\n clientId: \"lv1.1234567890abcdef\",\n clientSecret: \"1234567890abcdef12347890abcdef12345678\",\n refreshToken: \"r1.refreshtoken123\",\n request: request.defaults({\n baseUrl: \"https://ghe.my-company.com/api/v3\",\n }),\n});\n```\n\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n clientType\n | \n \n string\n | \n \n Required. Must be set to \"github-app\".\n | \n
\n clientId\n | \n \n string\n | \n \n Required. Your app's client ID\n | \n
\n clientSecret\n | \n \n string\n | \n \n Required. One of your app's client secrets\n | \n
\n target\n | \n \n string\n | \n \n Required unless targetId is set. The name of the user or organization to scope the user-to-server access token to.\n | \n
\n targetId\n | \n \n integer\n | \n \n Required unless target is set. The ID of the user or organization to scope the user-to-server access token to.\n | \n
\n repositories\n | \n \n array of strings\n | \n \n The list of repository names to scope the user-to-server access token to. repositories may not be specified if repository_ids is specified.\n | \n
\n repository_ids\n | \n \n array of integers\n | \n \n The list of repository IDs to scope the user-to-server access token to. repositories may not be specified if repositories is specified.\n | \n
\n permissions\n | \n \n object\n | \n \n The permissions granted to the user-to-server access token. See GitHub App Permissions.\n | \n
\n request\n | \n \n function\n | \n \n You can pass in your own @octokit/request instance. For usage with enterprise, set baseUrl to the REST API root endpoint. Example:\n\n```js\nimport { request } from \"@octokit/request\";\nconst { data, authentication } = await scopeToken({\n clientType: \"github-app\",\n clientId: \"lv1.1234567890abcdef\",\n token: \"usertoken123\",\n target: \"octokit\",\n repositories: [\"oauth-methods.js\"],\n permissions: {\n issues: \"write\",\n },\n request: request.defaults({\n baseUrl: \"https://ghe.my-company.com/api/v3\",\n }),\n});\n```\n\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n clientType\n | \n \n string\n | \n \n Must be set to \"oauth-app\" or \"github-app\".\n | \n
\n clientId\n | \n \n string\n | \n \n Required. Your app's client ID\n | \n
\n clientSecret\n | \n \n string\n | \n \n Required. One of your app's client secrets\n | \n
\n token\n | \n \n string\n | \n \n Required. The user access token to reset\n | \n
\n request\n | \n \n function\n | \n \n You can pass in your own @octokit/request instance. For usage with enterprise, set baseUrl to the REST API root endpoint. Example:\n\n```js\nimport { request } from \"@octokit/request\";\nconst { data, authentication } = await resetToken({\n clientId: \"1234567890abcdef1234\",\n clientSecret: \"secret\",\n token: \"usertoken123\",\n request: request.defaults({\n baseUrl: \"https://ghe.my-company.com/api/v3\",\n }),\n});\n```\n\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n clientType\n | \n \n string\n | \n \n Must be set to \"oauth-app\" or \"github-app\"\n | \n
\n clientId\n | \n \n string\n | \n \n Required. Your app's client ID\n | \n
\n clientSecret\n | \n \n string\n | \n \n Required. One of your app's client secrets\n | \n
\n token\n | \n \n string\n | \n \n Required. The user access token to delete\n | \n
\n request\n | \n \n function\n | \n \n You can pass in your own @octokit/request instance. For usage with enterprise, set baseUrl to the REST API root endpoint. Example:\n\n```js\nimport { request } from \"@octokit/request\";\nconst { data, authentication } = await deleteToken({\n clientId: \"1234567890abcdef1234\",\n clientSecret: \"secret\",\n token: \"usertoken123\",\n request: request.defaults({\n baseUrl: \"https://ghe.my-company.com/api/v3\",\n }),\n});\n```\n\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n clientType\n | \n \n string\n | \n \n Must be set to \"oauth-app\" or \"github-app\"\n | \n
\n clientId\n | \n \n string\n | \n \n Required. Your app's client ID\n | \n
\n clientSecret\n | \n \n string\n | \n \n Required. One of your app's client secrets\n | \n
\n token\n | \n \n string\n | \n \n Required. A valid user access token for the authorization\n | \n
\n request\n | \n \n function\n | \n \n You can pass in your own @octokit/request instance. For usage with enterprise, set baseUrl to the REST API root endpoint. Example:\n\n```js\nimport { request } from \"@octokit/request\";\nconst { data, authentication } = await deleteAuthorization({\n clientId: \"1234567890abcdef1234\",\n clientSecret: \"secret\",\n token: \"usertoken123\",\n request: request.defaults({\n baseUrl: \"https://ghe.my-company.com/api/v3\",\n }),\n});\n```\n\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n clientType\n | \n \n string\n | \n \n \"oauth-app\"\n | \n
\n clientId\n | \n \n string\n | \n \n The app's Client ID\n | \n
\n token\n | \n \n string\n | \n \n The user access token\n | \n
\n scopes\n | \n \n array of strings\n | \n \n array of scope names enabled for the token\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n clientType\n | \n \n string\n | \n \n \"github-app\"\n | \n
\n clientId\n | \n \n string\n | \n \n The app's Client ID\n | \n
\n token\n | \n \n string\n | \n \n The user access token\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n clientType\n | \n \n string\n | \n \n \"github-app\"\n | \n
\n clientId\n | \n \n string\n | \n \n The app's Client ID\n | \n
\n token\n | \n \n string\n | \n \n The user access token\n | \n
\n refreshToken\n | \n \n string\n | \n \n The refresh token\n | \n
\n expiresAt\n | \n \n string\n | \n \n Date timestamp in ISO 8601 standard. Example: 2022-01-01T08:00:0.000Z\n | \n
\n refreshTokenExpiresAt\n | \n \n string\n | \n \n Date timestamp in ISO 8601 standard. Example: 2021-07-01T00:00:0.000Z\n | \n