Github OAuth Token for Secured Authentication & Access

About Github OAuth Authentication

To keep your account secure, you must authenticate before accessing certain GitHub resources. When you authenticate with a GitHub OAuth token, you provide or confirm credentials that are unique to you in order to prove that you are who you say you are.

You can access your GitHub resources in a variety of ways, including the browser, GitHub Desktop, or another desktop application, the API, or the command line. Different modes of authentication are supported by each method of accessing GitHub.

• Two-factor authentication with username and password

• Token of personal access (as part of GitHub OAuth token)

• The SSH key

Using Your Browser To Authenticate

If you are a member of an enterprise with managed users, you will use your IdP to log in to GitHub in your browser with the help of a GitHub OAuth token. See ""Authenticating as a managed user"" in the GitHub Enterprise Cloud documentation for more information.

If you are not a member of an enterprise with managed users, you will use your GitHub.com username and password to log in. Two-factor authentication and SAML single sign-on are also options that may be required by organizations and enterprise owners.

• Only a username and password are required.

• When you create your GitHub account with GitHub OAuth token, you will create a password. To generate a random and unique password, we recommend using a password manager. See ""Creating a Strong Password"" for more information.

• If you have not enabled 2FA, GitHub will request additional verification when you sign in from an unknown device, such as a new browser profile, a browser with deleted cookies, or a new computer as part of the GitHub OAuth token process.

• After you enter your username and password, you will be prompted to enter a verification code, which we will send to you via email. If you have the GitHub Mobile app installed, you will instead receive a notification there. See ""GitHub Mobile"" for more information.

2FA Stands for Two-factor Authentication (Recommended)

• If you enable 2FA, we will prompt you to enter a code generated by a time-based one-time password (TOTP) application on your mobile device or sent as a text message after you successfully enter your username and password (SMS) in process of authentication with GitHub OAuth token. More information can be found at ""Using two-factor authentication to gain access to GitHub.

• You can optionally add an alternative method of authentication with GitHub Mobile or a security key using WebAuthn in addition to authentication with a TOTP application or a text message. For more information, see ""Configuring two-factor authentication with GitHub Mobile"" and ""Setting up two-factor authentication with a security key.

Single Sign-on With SAML

• You may need to authenticate through an IdP before you can access resources owned by an organization or enterprise account that uses SAML single sign-on. More information can be found in the GitHub Enterprise Cloud documentation under ""About authentication with SAML single sign-on.""

Using Github Desktop to Log in

You can use your browser to sign in to GitHub Desktop. See ""Authenticating to GitHub"" for more information.

Using the API to authenticate

There are several ways to authenticate with the API.

• Tokens of personal access

A personal access token can be used to access the API in limited circumstances, such as testing. You can revoke access at any time by using a personal access token. See ""Creating a Personal Access Token"" for more information.

• Web application flow

• You should use the web application flow to authenticate OAuth Apps in production. See ""Authorizing OAuth Apps"" for more information.

• GitHub Apps

• You should authenticate on behalf of the app installation for GitHub Apps in production. See ""Authenticating with GitHub Apps"" for more information.

Using the Command Line To Authenticate

You can access GitHub repositories from the command line in two ways: HTTPS and SSH, and both have different authentication methods. When you clone the repository, the method of authentication is determined by whether you use an HTTPS or SSH remote URL. See About remote repositories for more information on how to access them.

HTTPS

Even if you are behind a firewall or proxy, you can access all GitHub repositories via HTTPS.

If you use the GitHub CLI, you can either use a personal access token or a web browser to log in. See gh auth login for more information on GitHub CLI authentication.

If you authenticate without using the GitHub CLI, you must use a personal access token. Enter your personal access token when Git prompts you for your password (PAT). You can also use a credential helper, such as Git Credential Manager. Git's password-based authentication has been phased out in favour of more secure authentication methods. For more information, see ""Creating a personal access token."" Unless you cache your credentials with a credential helper, you'll be prompted to enter your credentials every time you use Git to authenticate with GitHub.

SSH

All GitHub repositories can be accessed via SSH, though firewalls and proxies may refuse SSH connections.

If you use the GitHub CLI to authenticate, the CLI will look for SSH public keys on your machine and prompt you to choose one for upload. If the GitHub CLI cannot locate an SSH public key to upload, it can generate a new SSH public/private key pair and upload the public key to your GitHub.com account. Then, you can either use a personal access token or a web browser to authenticate. See auth login for more information on GitHub CLI authentication.

If you authenticate without using the GitHub CLI, you must generate an SSH public/private key pair on your local machine and add the public key to your GitHub.com account. See ""Generating a new SSH key and adding it to the ssh-agent"" for more information. Unless you've saved the key, you'll be prompted to enter your SSH key passphrase every time you use Git to authenticate with GitHub.

Authorizing for SAML Single Sign-on

For using a personal access token or SSH key to access resources owned by an organization that uses SAML single sign-on, the personal token or SSH key must also be authorized. More information can be found in the GitHub Enterprise Cloud documentation under ""Authorizing a personal access token for use with SAML single sign-on"" or ""Authorizing an SSH key for use with SAML single sign-on.""

Github's Token Formats

Following are some of the GitHub-issued token systems that begin with a prefix to indicate the token's type and structure.

• Personal access token-ghp_Creating a personal access token

• OAuth access token -gho_Authorizing OAuth Apps

• Server-to-server token for a GitHub App-ghs_Authenticating with GitHub Apps

Closing Remarks

In conclusion, by using GitHub OAuth token and by authenticating to GitHub with different credentials depending on where you are, you can securely access your resources. This is a convenient way to keep your account safe while still allowing you to access your data from anywhere.