Connect your app to GitHub

To configure a GitHub connection, you will need to register Auth0 with GitHub.

This doc refers to the steps to connect your application. If you are looking to manage authentication in your application, see Next Steps below.

1. Add a new application

To add a new application, log in to GitHub and go to OAuth applications in your developer settings. Next click Register a new application.

2. Register your new app

On the Register a new application page fill out the form with the following information:

Field Description
Application name The name of your app
Homepage URL https://YOUR_AUTH0_DOMAIN
Application description The description of your app users will see (Optional)
Authorization callback URL https://YOUR_AUTH0_DOMAIN/login/callback

After completing the form click Register application to proceed.

3. Get your GitHub app's Client ID and Client Secret

Once the application is registered, your app's Client ID and Client Secret will be displayed on the following page:

4. Copy your GitHub app's Client ID and Client Secret

Go to your Auth0 Dashboard and select Connections > Social, then choose Github. Copy the Client ID and Client Secret from the Developer Applications of your app on Github into the fields on this page on Auth0.

5. Access GitHub API

Once you successfully authenticate a user, GitHub includes an Access Token in the user profile it returns to Auth0.

You can then use this token to call their API.

In order to get a GitHub Access Token, you have to retrieve the full user's profile, using the Auth0 Management API, and extract the Access Token from the response. For detailed steps refer to Call an Identity Provider API.

Once you have the token you can call the API, following GitHub's documentation.

For more information on these tokens, refer to Identity Provider Access Tokens.


If you are receiving Access Denied when calling the GitHub API, you probably have not requested the correct permissions for the user during login. For information on how to fix that, refer to Add scopes/permissions to call Identity Provider's APIs.