# GitHub (OAuth Apps and GitHub Apps): OAuth app setup guide

> Curated guide, updated 2026-10-30. Source: https://oauthseus.vercel.app/guides/github

**Difficulty:** easy. 15-45 minutes to register and test; no GitHub review to go public. Marketplace listing (optional) adds an unpublished-length review, reportedly 2-6 weeks. _[documented s12,s2,s9,s17]_

GitHub has no app review for going public: you can register a GitHub App (recommended) or an OAuth App in minutes and any GitHub user can connect immediately. The real friction is on your users' side: organization owners must install a GitHub App on their org, or approve an OAuth App when OAuth app access restrictions are on (the default for new orgs). Only a GitHub Marketplace listing involves a GitHub review, and paid plans additionally need a verified-publisher organization and 100+ installs.

**Your work:** 20–60 min. **Waiting on provider:** None (review depends on path).

No GitHub approval is needed to register an app or make a GitHub App public. A GitHub review happens only if you submit a GitHub Marketplace listing (an onboarding expert reviews it; GitHub publishes no timeline). Separately, each customer organization's owner must install your GitHub App, or approve your OAuth App if OAuth app access restrictions are enabled; that wait depends on the customer, not GitHub.

## Launch paths

| Path | Difficulty | Your work | Provider wait |
|---|---|---|---|
| Personal / testing (private GitHub App) | easy | 15–30 min | None |
| Public GitHub App (no Marketplace) - recommended default | easy | 30–90 min | None |
| OAuth App (legacy model; enterprise-level access) | easy | 15–30 min | None |
| GitHub Marketplace listing (free or paid) | hard | 1–3 days | 2–6 weeks |

## Do these first

1. Decide GitHub App (default) vs OAuth App; list exactly which repo/org permissions your agent needs
2. Register a private GitHub App ("Only on this account") with a localhost callback and Device Flow if you ship a CLI
3. Implement PKCE web flow or device flow plus 8-hour token refresh, and test end-to-end on your own account
4. Switch to "Any account", add production callback URLs, and publish your install link with an org-owner help note
5. Only if you want discovery or GitHub billing: prepare Marketplace assets and webhooks, then request publish

## What you're registering

**GitHub App (recommended) or OAuth App, registered under a personal account or organization in Developer settings.** One GitHub App registration represents your agent product. Customers 'install' it on their user or org account and choose which repositories it can reach; each installation yields short-lived installation access tokens (app acting as itself). When a user 'authorizes' it, you get a user access token that can only reach resources both the user and the app installation can access. An OAuth App instead has no installation concept: each user authorization yields a scope-limited token acting as that user across everything they can see (subject to org approval).

GitHub App user access tokens expire after 8 hours with a refresh token valid 6 months (option "Expire user authorization tokens", on by default; strongly recommended). Using a refresh token invalidates it and the old access token. Installation access tokens expire after 1 hour and are minted with a JWT signed by the app's private key (keys never expire; up to 25 per app). OAuth Apps now also offer expiring tokens (8h / 6-month refresh) via "Expire user access tokens", enabled by default on new registrations; otherwise OAuth tokens live until revoked. The `scope` parameter grants nothing to a GitHub App; permissions come from the app registration. Authorization codes expire after 10 minutes.

## What you'll need

- **GitHub account (personal or organization owner)**: Register under your personal account or under an org you own (or where you are a GitHub App manager). Each account can register up to 100 GitHub Apps and up to 100 OAuth Apps. For a product, register under an organization so the app survives staff changes and is eligible for paid Marketplace plans. _[documented s2]_
- **Globally unique app name (max 34 characters)**: GitHub App names must be unique across GitHub and cannot match an existing account name unless it is your own. The slug (lowercased, spaces to '-') appears in the UI when the app acts. _[documented s2]_
- **Homepage URL**: Required. If you lack a site, a public repository URL or the owning account URL is acceptable. _[documented s2]_
- **Callback URL(s) (web flow) or Device Flow enabled (CLI/headless agents)**: Both GitHub Apps and OAuth Apps accept up to 10 callback URLs; pass `redirect_uri` to choose one, otherwise the first is used. Optional wildcard matching for subdomains/subdirectories exists but is a security risk. Headless agents should enable Device Flow (no callback or client secret needed). _[documented s6]_
- **Minimum permissions (GitHub App) or scopes (OAuth App)**: Pick Read-only / Read & write / No access per permission. Changing permissions later forces every installation owner to re-approve, so get them right before going public. _[documented s2]_
- **Private key (GitHub App) and client secret**: Generate a private key (PEM, PKCS#1) to sign JWTs for installation tokens; generate a client secret for the web flow token exchange. Store both in a secrets manager. _[documented s21]_
- **Org owner action at each customer organization**: GitHub App: only an org owner or repo admin can install (members can request). OAuth App: if OAuth app access restrictions are enabled, an org owner must approve the app before members' tokens can reach org resources. Restrictions are on by default for new orgs. _[documented s9]_
- **Marketplace listing assets and policies**: Publisher contact info, description, pricing plan, valid privacy policy link, support link or email, logo, feature card and screenshots, Marketplace plan-change webhooks, and value beyond authentication. Only org owners (not GitHub App managers) can submit org-owned listings. _[documented s15]_
- **Publisher verification (paid plans or Marketplace badge only)**: App must be owned by an organization; org needs accurate profile and email, org-wide two-factor authentication required, and a verified domain with a 'Verified' badge on the org profile. _[documented s16]_
- **Install / user thresholds for paid plans**: Paid apps: GitHub Apps should have at least 100 installations; OAuth Apps at least 200 users. Must handle Marketplace purchase events (new, upgrade, downgrade, cancel, free trial) and support monthly and annual billing. _[documented s15]_

## Steps

### 1. Decide: GitHub App (default) vs OAuth App (5–15 min, agent can do)

1. Pick a GitHub App unless you need enterprise-level resources (the enterprise object itself), which only OAuth Apps can be granted.
2. GitHub App advantages for an AI agent: fine-grained permissions (e.g. read-only contents instead of `repo`), users choose specific repositories, expiring tokens, rate limits that scale with installations, a built-in webhook, and no dependency on org OAuth app policies.
3. Decide whether the agent acts as the user (user access token via web or device flow), as itself (installation token via private key + JWT), or both. Agents that open PRs as a bot use installation tokens; agents that act 'as you' use user access tokens.
4. For CLI or terminal agents without a browser redirect, plan to use the device flow.

[Deciding when to build a GitHub App](https://docs.github.com/en/apps/creating-github-apps/about-creating-github-apps/deciding-when-to-build-a-github-app) · [Differences between GitHub Apps and OAuth apps](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps) _[documented s4]_

### 2. Open Developer settings > GitHub Apps (1–3 min, you)

1. Click your profile picture (upper-right) and click "Settings". For an org-owned app: "Your organizations" > "Settings" next to the org.
2. In the left sidebar click "Developer settings", then "GitHub Apps".
3. Click "New GitHub App".

[Registering a GitHub App](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/registering-a-github-app) _[documented s2]_

### 3. Fill in the New GitHub App form (10–25 min, agent prepares, you submit)

1. "GitHub App name": unique, 34 characters max.
2. "Homepage URL": your product site (or repo URL).
3. "Callback URL": your OAuth redirect (e.g. https://yourapp.com/auth/github/callback). Click "Add callback URL" to add a localhost dev URL too (up to 10 total).
4. Leave "Expire user authorization tokens" selected (8h tokens + 6-month refresh tokens).
5. Select "Request user authorization (OAuth) during installation" if you want the install and user login to happen in one hop (this disables "Setup URL").
6. Select "Enable Device Flow" for CLI/terminal agents.
7. Webhooks: deselect "Active" if the agent does not react to events; otherwise set "Webhook URL" and a "Webhook secret" and keep SSL verification enabled.
8. "Permissions": set only what the agent needs (e.g. Repository > Contents: Read-only, Issues: Read & write).
9. "Where can this GitHub App be installed?": "Only on this account" for testing, "Any account" to let customers connect.
10. Click "Create GitHub App". Note the App ID and Client ID shown on the settings page.
   - Callback URL: `https://YOUR_DOMAIN/auth/github/callback` (Add http://localhost:3000/auth/github/callback as a second URL for development.)
   - Expire user authorization tokens: `checked` (GitHub strongly recommends leaving this on.)
   - Where can this GitHub App be installed?: `Any account` (Use 'Only on this account' while testing.)

[Registering a GitHub App](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/registering-a-github-app) · [Choosing permissions for a GitHub App](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/choosing-permissions-for-a-github-app) · [About the user authorization callback URL](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/about-the-user-authorization-callback-url) _[documented s2]_

### 4. Generate a client secret and a private key (3–10 min, you)

1. Developer settings > GitHub Apps > click "Edit" next to your app.
2. Under the app's credentials, generate a client secret (needed for the web flow code exchange; not needed for the device flow) and copy it immediately.
3. In the left sidebar click "Key pairs", then "New key". A PEM file downloads; GitHub keeps only the public half.
4. Store Client ID, client secret, App ID and the PEM in your secrets manager. Keep at least two keys if you want zero-downtime rotation (max 25).

[Managing private keys for GitHub Apps](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/managing-private-keys-for-github-apps) _[documented s21]_

### 5. (OAuth App path) Register a new OAuth App (5–10 min, agent prepares, you submit)

1. Settings > "Developer settings" > "OAuth apps" > "New OAuth App" (shows "Register a new application" if you have never created one).
2. Fill "Application name", "Homepage URL", optional "Application description" and "Authorization callback URL". Click "Add callback URL" for more (up to 10).
3. Check "Enable Device Flow" for CLI agents.
4. "Expire user access tokens" is enabled by default; leave it on and implement refresh, or uncheck only if your code cannot handle refresh yet.
5. Click "Register application", then generate a client secret on the app page.
6. Only use information you consider public in the registration.
   - Authorization callback URL: `https://YOUR_DOMAIN/auth/github/callback`

[Creating an OAuth app](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app) · [Scopes for OAuth apps](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps) _[documented s1]_

### 6. Implement the user authorization flow (web flow with PKCE, or device flow) (1–4 hours, agent can do)

1. Web flow: redirect to https://github.com/login/oauth/authorize with client_id, redirect_uri, a random state, and PKCE code_challenge (S256 only; 'plain' unsupported). Exchange the code (valid 10 minutes) at POST https://github.com/login/oauth/access_token.
2. Device flow: POST https://github.com/login/device/code with client_id; show user_code and https://github.com/login/device; poll POST https://github.com/login/oauth/access_token at the returned interval (default 5s). Codes expire after 900 seconds. A slow_down error adds 5 seconds to the interval. No client secret needed.
3. Store refresh_token (ghr_ prefix) and expires_in (28800s). Refresh before expiry; each refresh rotates both tokens, so persist the new pair atomically.
4. For GitHub App bot actions: sign a JWT with the private key, then create an installation access token (1-hour lifetime) per installation.
5. Do not send `scope` for GitHub Apps except `offline_access`; permissions come from the app registration.

[Generating a user access token for a GitHub App](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-user-access-token-for-a-github-app) · [Refreshing user access tokens](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/refreshing-user-access-tokens) · [Authorizing OAuth apps (device flow)](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps#device-flow) _[documented s8]_

### 7. Make the GitHub App public and share the install link (2–5 min, you)

1. If you registered with "Only on this account", open the app settings ("Edit") > "Advanced" and change visibility to public. No review is triggered.
2. Share https://github.com/apps/YOUR-APP-SLUG (landing page with an "Install" button) or https://github.com/apps/YOUR-APP-SLUG/installations/new.
3. Tell org customers that an org owner (or repo admin for selected repos) must click "Install" and choose "All repositories" or selected ones.

[Making a GitHub App public or private](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/making-a-github-app-public-or-private) · [Modifying a GitHub App registration](https://docs.github.com/en/apps/maintaining-github-apps/modifying-a-github-app-registration) _[documented s12]_

### 8. Get org access at each customer organization (5–15 min, you)

1. GitHub App: an org owner installs it from the app's landing page; members can only request installation.
2. OAuth App with restrictions on: the member first authorizes the app for their personal account, then goes to Settings > "Applications" > "Authorized OAuth Apps" tab > app > "Request access" next to the org > "Request approval from owners".
3. The org owner approves at Org Settings > "Third-party Access" > "OAuth app policy" > "Review" > "Grant access".
4. Provide customers a short help article with these exact steps.

[Approving OAuth apps for your organization](https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization) · [Requesting organization approval for OAuth apps](https://docs.github.com/en/account-and-profile/how-tos/organization-membership/requesting-organization-approval-for-oauth-apps) _[documented s10]_

### 9. (Paid Marketplace only) Request publisher verification (30–120 min, you)

1. Transfer the app to an organization if it is personally owned.
2. Org Settings > "Developer settings" > "Publisher Verification".
3. Complete the checklist: accurate profile and email, org two-factor authentication required, verified domain showing a 'Verified' badge.
4. Click "Request Verification" and wait for GitHub to notify you (no published timeline).

[Applying for publisher verification](https://docs.github.com/en/apps/github-marketplace/github-marketplace-overview/applying-for-publisher-verification-for-your-organization) · [Verifying a domain for your organization](https://docs.github.com/en/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization) _[documented s16]_

### 10. (Marketplace) Draft the listing and request publish (4–16 hours, agent prepares, you submit)

1. App must be public. On the app settings page scroll to the Marketplace section and click "List in Marketplace" (or go to https://github.com/marketplace/new and click "Create draft listing").
2. Complete contact info, description, logo, feature card, screenshots, privacy policy link, support link/email and at least one pricing plan.
3. Implement Marketplace webhook events for plan changes and cancellations.
4. On the listing "Overview", accept the GitHub Marketplace Developer Agreement and click "Request publish" (some doc pages call it "Submit for review").
5. An onboarding expert contacts you; respond promptly to their questions.

[Requirements for listing an app](https://docs.github.com/en/apps/github-marketplace/creating-apps-for-github-marketplace/requirements-for-listing-an-app) · [Drafting a listing for your app](https://docs.github.com/en/apps/github-marketplace/listing-an-app-on-github-marketplace/drafting-a-listing-for-your-app) · [Submitting your listing for publication](https://docs.github.com/en/apps/github-marketplace/listing-an-app-on-github-marketplace/submitting-your-listing-for-publication) _[documented s17]_

## Blockers

- **Users can sign in but the agent cannot see org repositories (OAuth App)** (high). Symptom: API calls for org private repos return 404/403 or empty lists; webhooks from org private repos stop arriving. Fix: The org has OAuth app access restrictions enabled (default for new orgs). Ask the user to click "Request access" for the org under Settings > Applications > Authorized OAuth Apps, and have an org owner grant access under "OAuth app policy". Long-term: switch to a GitHub App, which is not subject to org application policies. _[documented s9]_
- **GitHub App user token cannot access a repo the user clearly can** (high). Symptom: User access token returns 404 for a repo the user owns or belongs to. Fix: User access tokens only reach resources both the user and the app can access. The app must be installed on that account/org and the repo included in the installation. Send the user to https://github.com/apps/YOUR-SLUG/installations/new. _[documented s8]_
- **Org members cannot install your GitHub App** (medium). Symptom: Non-owner members only see a 'request' option; installation stalls waiting on an org owner. Fix: Only org owners (or repo admins for their repos) can install. Give customers an owner-facing install link and explanation of the minimal permissions requested. _[documented s3]_
- **Tokens suddenly invalid after 8 hours, or refresh fails** (medium). Symptom: 401 Bad credentials after ~8 hours; refresh requests fail after a refresh token was already used once. Fix: Expiring tokens are on by default. Refresh with grant_type=refresh_token before expiry and atomically persist the new access + refresh token; each refresh token is single-use. Refresh tokens expire after 6 months, after which the user must re-authorize. _[documented s5]_
- **redirect_uri mismatch** (medium). Symptom: GitHub shows a redirect_uri mismatch error instead of the consent screen. Fix: Register every environment's callback (up to 10) and pass the matching redirect_uri explicitly; without it GitHub uses the first registered URL. Avoid wildcard matching unless you control every subdomain/path. _[documented s6]_
- **Device flow errors: device_flow_disabled or slow_down** (low). Symptom: Polling returns device_flow_disabled, or repeated slow_down errors. Fix: Tick "Enable Device Flow" in app settings; respect the returned interval (default 5s) and add 5s after each slow_down. Restart the flow after 900 seconds. _[documented s8]_
- **Rate limits hit by an agent doing many API calls** (medium). Symptom: 403/429 with x-ratelimit-remaining: 0, or secondary rate limit errors when creating content quickly. Fix: User tokens share the user's 5,000 req/hour; installation tokens start at 5,000/hour and scale with repos and users (15,000 on GitHub Enterprise Cloud). Prefer installation tokens for bulk work, use conditional requests, and keep content creation under 80/minute and 500/hour. _[documented s13]_
- **Paid Marketplace listing blocked** (medium). Symptom: Cannot add a paid plan or request verification. Fix: Transfer the app to an organization, require 2FA for the org, verify a domain, complete Publisher Verification, and reach 100 installations (GitHub App) / 200 users (OAuth App). Launch as a free listing or off-Marketplace first. _[documented s15]_

## Agent vs. you

**An agent can:**
- Choose GitHub App vs OAuth App from your requirements and draft the minimal permission set
- Draft every registration value: app name candidates, description, homepage, callback URLs, webhook URL
- Implement the web flow with state + PKCE, the device flow for CLI agents, refresh-token rotation and installation-token minting (JWT signing)
- Write the org-owner help article explaining install / OAuth approval steps
- Write Marketplace listing copy, privacy policy draft and the Marketplace plan-change webhook handler
- Add rate-limit handling (conditional requests, backoff on secondary limits)

**You must:**
- Log in to GitHub (with 2FA) and click "Create GitHub App" / "Register application" yourself
- Generate and securely store the client secret and private key PEM
- Decide on and own the org that owns the app; enable org 2FA and verify the domain via DNS for publisher verification
- Accept the GitHub Marketplace Developer Agreement and click "Request publish" (legal acceptance)
- Get each customer org owner to install the GitHub App or approve the OAuth App

## What we couldn't confirm

- GitHub publishes no review timeline for Marketplace listings or publisher verification; the 2-6 week range is community-reported (unverified), and a 2018 GitHub blog post cited ~2 weeks.
- Exact current button label for generating a client secret on a GitHub App settings page (we used 'Generate a new client secret') is not stated in the docs we read; private-key labels are now 'Key pairs' > 'New key'.
- Marketplace submit button label differs across docs: 'Request publish' (Submitting your listing) vs 'Submit for review' (Drafting a listing).
- The 'Advanced' page location for changing GitHub App visibility is inferred from Modifying a GitHub App registration; the exact control label was not captured.
- Refresh token lifetime: GitHub App docs say six months; OAuth App docs say six months 'without use'. Whether GitHub App refresh tokens are also use-based was not confirmed.
- The 'Deciding when to build a GitHub App' page still says OAuth app tokens do not expire until revoked, while the OAuth App creation page says expiring tokens are enabled by default for new apps; behavior for existing OAuth Apps is opt-in.

## Verification log

- 2026-10-30 · doc-review · **corrected**: OAuth Apps allow only one callback URL (commonly repeated advice). Current 'Creating an OAuth app' doc says you can enter up to 10 callback URLs via 'Add callback URL'. The older 'GitHub Apps allow multiple, OAuth Apps one' distinction no longer holds; both allow up to 10.
- 2026-10-30 · doc-review · **corrected**: OAuth App tokens never expire. 'Creating an OAuth app' now shows 'Expire user access tokens' enabled by default (8h access token, 6-month refresh token). The 'Deciding when to build a GitHub App' page still states OAuth tokens do not expire until revoked, so GitHub's own docs are inconsistent; existing apps keep long-lived tokens unless switched.
- 2026-10-30 · doc-review · **corrected**: GitHub App private key generated via 'Generate a private key' button. Current docs describe app settings sidebar 'Key pairs' > 'New key' within a 'Credentials' section; the older single 'Generate a private key' button wording is outdated.
- 2026-10-30 · doc-review · **confirmed**: GitHub App user tokens expire after 8 hours with 6-month refresh tokens. Refreshing user access tokens: expires_in always 28800, refresh_token_expires_in 15897600; 'Expire user authorization tokens' strongly recommended. The page also labels expiring tokens as an optional feature subject to change.
- 2026-10-30 · doc-review · **confirmed**: No GitHub review required to make a GitHub App public. Making a GitHub App public or private and Registering a GitHub App describe visibility as a setting with no review; only Marketplace listing involves an onboarding expert review.
- 2026-10-30 · doc-review · **confirmed**: Org owners must approve OAuth apps. Only when OAuth app access restrictions are enabled, which is the default for new organizations. Orgs without restrictions let any member-authorized OAuth app access private org resources. GitHub Apps are not subject to these policies but require owner/admin installation.
- 2026-10-30 · doc-review · **corrected**: Marketplace verification required for all listings. Publisher verification is only required for paid plans or the Marketplace badge; free listings need only the general listing requirements. Paid apps also need 100 installs (GitHub App) / 200 users (OAuth App).
- 2026-10-30 · doc-review · **confirmed**: PKCE support in GitHub web flow. Generating a user access token lists code_challenge / code_challenge_method as strongly recommended; only S256 supported.
- 2026-10-30 · doc-review · **unverifiable**: Marketplace review timeline. Submitting your listing for publication says only that an onboarding expert will reach out; no duration published. Community range 2-6 weeks recorded as unverified.
- 2026-10-30 · http-probe · **confirmed**: Automated: developer console (https://github.com/settings/developers). Console is live and sits behind sign-in: redirected to github.com ("Sign in to GitHub · GitHub"). An agent cannot go further without your account.
- 2026-10-30 · http-probe · **confirmed**: Automated: authorize endpoint with a fake client_id (https://github.com/login/oauth/authorize). Endpoint is live; responded 302 redirecting to github.com (usually sign-in before client validation).
- 2026-10-30 · doc-review · **confirmed**: Automated: 34 quotes re-fetched and matched against their cited pages. 34 of 34 quotes found verbatim in the live page HTML.  21/21 source URLs returned HTTP 200.

## Sources

- s1: [Creating an OAuth app](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app) (official-docs, accessed 2026-10-30)
- s2: [Registering a GitHub App](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/registering-a-github-app) (official-docs, accessed 2026-10-30)
- s3: [Differences between GitHub Apps and OAuth apps](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps) (official-docs, accessed 2026-10-30)
- s4: [Deciding when to build a GitHub App](https://docs.github.com/en/apps/creating-github-apps/about-creating-github-apps/deciding-when-to-build-a-github-app) (official-docs, accessed 2026-10-30)
- s5: [Refreshing user access tokens](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/refreshing-user-access-tokens) (official-docs, accessed 2026-10-30)
- s6: [About the user authorization callback URL](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/about-the-user-authorization-callback-url) (official-docs, accessed 2026-10-30)
- s7: [Authorizing OAuth apps](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps) (official-docs, accessed 2026-10-30)
- s8: [Generating a user access token for a GitHub App](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-user-access-token-for-a-github-app) (official-docs, accessed 2026-10-30)
- s9: [About OAuth app access restrictions](https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/about-oauth-app-access-restrictions) (official-docs, accessed 2026-10-30)
- s10: [Approving OAuth apps for your organization](https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization) (official-docs, accessed 2026-10-30)
- s11: [Requesting organization approval for OAuth apps](https://docs.github.com/en/account-and-profile/how-tos/organization-membership/requesting-organization-approval-for-oauth-apps) (official-docs, accessed 2026-10-30)
- s12: [Making a GitHub App public or private](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/making-a-github-app-public-or-private) (official-docs, accessed 2026-10-30)
- s13: [Rate limits for the REST API](https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api) (official-docs, accessed 2026-10-30)
- s14: [About GitHub Marketplace for apps](https://docs.github.com/en/apps/github-marketplace/github-marketplace-overview/about-github-marketplace-for-apps) (official-docs, accessed 2026-10-30)
- s15: [Requirements for listing an app](https://docs.github.com/en/apps/github-marketplace/creating-apps-for-github-marketplace/requirements-for-listing-an-app) (official-docs, accessed 2026-10-30)
- s16: [Applying for publisher verification for your organization](https://docs.github.com/en/apps/github-marketplace/github-marketplace-overview/applying-for-publisher-verification-for-your-organization) (official-docs, accessed 2026-10-30)
- s17: [Submitting your listing for publication](https://docs.github.com/en/apps/github-marketplace/listing-an-app-on-github-marketplace/submitting-your-listing-for-publication) (official-docs, accessed 2026-10-30)
- s18: [Navigating GitHub Marketplace App Submissions: Understanding Review Timelines and Support (DevActivity)](https://devactivity.com/insights/navigating-github-marketplace-app-submissions-understanding-review-timelines-and-support-a-devactivity-insight) (community, accessed 2026-10-30)
- s19: [GitHub Marketplace one year after release (GitHub Blog, Japanese, 2018)](https://github.blog/jp/2018-05-29-marketplace-anniversary/) (official-blog, accessed 2026-10-30)
- s20: [Drafting a listing for your app](https://docs.github.com/en/apps/github-marketplace/listing-an-app-on-github-marketplace/drafting-a-listing-for-your-app) (official-docs, accessed 2026-10-30)
- s21: [Managing private keys for GitHub Apps](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/managing-private-keys-for-github-apps) (official-docs, accessed 2026-10-30)
- p1: [Live probe (console): Console is live and sits behind sign-in: redirected to github.com ("Sign in to GitHub · GitHub"). An](https://github.com/settings/developers) (probe, accessed 2026-10-30)
- p2: [Live probe (authorize-endpoint): Endpoint is live; responded 302 redirecting to github.com (usually sign-in before client validation)](https://github.com/login/oauth/authorize) (probe, accessed 2026-10-30)

Evidence tags: tested = exercised live; documented = official source, quote checked; inferred = reasoning; unverified = unconfirmed.