airbytehq / airbytehq/airbyte

[source-github] Add GitHub App authentication support

Open
#75,188 4 comments 1 reaction 0 assignees View on GitHub
autoteam community connectors/source/github team/use
Dominant language
Python
Stars
22.1k
Forks
5.3k
PR merge metrics
PR metrics pending

Description

## Describe the feature

The source-github connector currently supports two authentication methods:
- Personal Access Token (PAT)
- OAuth

Many organizations use **GitHub Apps** for machine-to-machine authentication because they offer:
- **Fine-grained permissions** scoped to specific repositories
- **Higher rate limits** (5,000 requests/hour per installation vs 5,000 per user for PATs)
- **No dependency on individual user accounts** — the app persists even when employees leave
- **Required by policy** in many enterprise environments that prohibit long-lived PATs

## Proposed behavior

Add a third authentication option to the connector spec accepting:
- `app_id` — The GitHub App's ID
- `installation_id` — The installation ID for the target org/account
- `private_key` — The PEM-format private key (marked as `airbyte_secret`)

At sync time, the connector would:
1. Create a JWT signed with the private key
2. Exchange it for a short-lived installation access token via the GitHub API
3. Use that token for all API requests (same as PAT auth from that point on)

Installation tokens expire after 1 hour, which is sufficient for most syncs.

## Additional context

This also requires the connector to support configurable API URLs (for GitHub Enterprise Server) in the rate-limit checking code, which currently has `https://api.github.com` hardcoded.

---
**Internal Tracking:** https://github.com/airbytehq/oncall/issues/11694

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.