> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# GitHub connection

> Learn how to configure a GitHub Connection for Infisical.

Infisical supports three methods for connecting to GitHub.

> [tab] GitHub App (Recommended)
>
> Infisical will use a GitHub App with finely grained permissions to connect to GitHub.
>
> > [accordion] Self-Hosted Instance
> >
> > Using the GitHub integration with app authentication on a self-hosted instance of Infisical requires configuring an application on GitHub
> > and registering your instance with it.
> >
> > **1. Create an application on GitHub**
> >
> > Navigate to the GitHub App settings [here](https://github.com/settings/apps). Click **New GitHub App**.
> >
> > ![integrations github app create](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/github/app/self-hosted-github-app-create.png)
> >
> > Give the application a name, a homepage URL (your self-hosted domain i.e. `https://your-domain.com`), and a callback URL (i.e. `https://your-domain.com/organization/app-connections/github/oauth/callback`).
> >
> > ![integrations github app basic details](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/github/app/self-hosted-github-app-basic-details.png)
> >
> > Enable request user authorization during app installation.
> >
> > ![integrations github app enable auth](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/github/app/self-hosted-github-app-enable-oauth.png)
> >
> > Disable webhook by unchecking the Active checkbox.
> >
> > ![integrations github app webhook](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/github/app/self-hosted-github-app-webhook.png)
> >
> > Every connection that uses this app shares the app's permissions, so if you leave out the permissions for a secret type, no one can sync that type through the app.
> >
> > Under **Permissions**, set the permissions for every [type of GitHub secret](https://infisical.com/docs/integrations/secret-syncs/github.md#secret-types) you plan to sync:
> >
> > > [accordion] Actions secrets
> > >
> > > * To sync to a repository, set the repository permission **Secrets** to Read and write
> > > * To sync to a repository environment, also set the repository permission **Environments** to Read and write, and **Actions** to Read-only
> > > * To sync to an organization, set the organization permission **Secrets** to Read and write
> > >
> > > ![integrations github app organization](https://infisical.com/docs/images/integrations/github/app/self-hosted-github-app-organization.png)
> >
> > > [accordion] Dependabot secrets
> > >
> > > * To sync to a repository, set the repository permission **Dependabot secrets** to Read and write
> > > * To sync to an organization, set the organization permission **Organization dependabot secrets** to Read and write
> > >
> > > ![Dependabot secrets set to Read and write in the GitHub App's repository permissions](https://infisical.com/docs/images/app-connections/github/github-app-dependabot-secrets-permission.png)
> >
> > > [accordion] Codespaces secrets
> > >
> > > GitHub Enterprise Server doesn't include Codespaces, so you can't sync Codespaces secrets through a GitHub Enterprise Server connection.
> > >
> > > * To sync to a repository, set the repository permission **Codespaces secrets** to Read and write
> > > * To sync to an organization, set the organization permission **Organization codespaces secrets** to Read and write
> > >
> > > ![Codespaces secrets set to Read and write in the GitHub App's repository permissions](https://infisical.com/docs/images/app-connections/github/github-app-codespaces-secrets-permission.png)
> >
> > ![integrations github app repository](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/github/app/self-hosted-github-app-repository.png)
> >
> > Create the GitHub application.
> >
> > ![integrations github app create confirm](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/github/app/self-hosted-github-app-create-confirm.png)
> >
> > > [!NOTE]
> > >
> > > If you have a GitHub organization, you can create an application under it
> > > in your organization Settings > Developer settings > GitHub Apps > New GitHub App.
> >
> > **2. Add your application credentials to Infisical**
> >
> > Generate a new **Client Secret** for your GitHub application.
> >
> > ![integrations github app create secret](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/github/app/self-hosted-github-app-secret.png)
> >
> > Generate a new **Private Key** for your GitHub application.
> >
> > ![integrations github app create private key](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/github/app/self-hosted-github-app-private-key.png)
> >
> > Obtain the necessary GitHub application credentials. This would be the application slug, client ID, app ID, client secret, and private key.
> >
> > ![integrations github app credentials](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/github/app/self-hosted-github-app-credentials.png)
> >
> > Back in your Infisical instance, you can configure the GitHub App credentials in one of two ways:
> >
> > **Option 1: Server Admin Panel (Recommended)**
> >
> > Navigate to the server admin panel > **Integrations** > **GitHub App** and enter the GitHub application credentials:
> >
> > ![integrations github app admin panel](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/github/app/self-hosted-github-app-admin-panel.png)
> >
> > * **Client ID**: The Client ID of your GitHub application
> > * **Client Secret**: The Client Secret of your GitHub application
> > * **App Slug**: The Slug of your GitHub application (found in the URL)
> > * **App ID**: The App ID of your GitHub application
> > * **Private Key**: The Private Key of your GitHub application
> >
> > **Option 2: Environment Variables**
> >
> > Alternatively, you can add the new environment variables for the credentials of your GitHub application:
> >
> > * `INF_APP_CONNECTION_GITHUB_APP_CLIENT_ID`: The **Client ID** of your GitHub application.
> >
> > * `INF_APP_CONNECTION_GITHUB_APP_CLIENT_SECRET`: The **Client Secret** of your GitHub application.
> >
> > * `INF_APP_CONNECTION_GITHUB_APP_SLUG`: The **Slug** of your GitHub application. This is the one found in the URL.
> >
> > * `INF_APP_CONNECTION_GITHUB_APP_ID`: The **App ID** of your GitHub application.
> >
> > * `INF_APP_CONNECTION_GITHUB_APP_PRIVATE_KEY`: The **Private Key** of your GitHub application.
> >
> > * `INF_APP_CONNECTION_GITHUB_APP_HOST` *(GitHub Enterprise Server only)*: The hostname of the GitHub instance where the shared GitHub App is registered (e.g. `github.mycompany.com`). Only required when the shared app is registered on a GHES instance. Defaults to `github.com`.
> >
> > > [!NOTE]
> > >
> > > If your shared GitHub App is registered on a GitHub Enterprise Server instance, you must set `INF_APP_CONNECTION_GITHUB_APP_HOST` to that instance's hostname. Without it, the OAuth exchange will be directed to `github.com` instead of your GHES host.
> >
> > Once configured, you can use the GitHub integration via app authentication. If you configured the credentials using environment variables, restart your Infisical instance for the changes to take effect. If you configured them through the server admin panel, allow approximately 5 minutes for the changes to propagate.
>
> ## Setup GitHub connection in Infisical
>
> **1. Navigate to App Connections**
>
> Navigate to the **Integrations** tab in the desired project, then select **App Connections**.
>
> ![App Connections Tab](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/general/add-connection.png)
>
> **2. Add Connection**
>
> Select the **GitHub Connection** option from the connection options modal.
>
> ![Select GitHub Connection](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/github/select-github-connection.png)
>
> **3. Authorize Connection**
>
> Select the **GitHub App** method.
>
> Choose which GitHub App to use for the connection:
>
> * **Instance** — the instance-default GitHub App configured by your Infisical server admin.
>
> * **Private** — a GitHub App registered under your organization. Select an existing one from the list, or click the gear to manage your private apps.
>
> > [!NOTE]
> >
> > GitHub Apps are scoped to where they were created: apps created from the organization's App Connections page are available to organization-level connections and to every project, while apps created from a project's App Connections page are only available within that project. The shared instance-default app is available in both scopes.
>
> ![Select GitHub App](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/github/select-github-app.png)
>
> When managing your apps, you can inspect them on GitHub, delete existing apps, or click **Create New GitHub App** to register a new app directly from Infisical using GitHub’s App Manifest flow. New apps are automatically configured with the required permissions and callback URLs.
>
> ![Manage GitHub Apps](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/github/manage-github-app.png)
>
> ![Create New GitHub App](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/github/create-new-github-app.png)
>
> > [!NOTE]
> >
> > If your GitHub App was created before Infisical supported Dependabot and Codespaces secrets, the app is missing the permissions those secret types need. To sync them, add the [missing permissions](https://infisical.com/docs/integrations/secret-syncs/github.md#secret-types) to the app on GitHub. An owner of each installation then has to approve the new permissions before Infisical can use them.
>
> You may optionally enable **GitHub Enterprise** to configure enterprise-specific options:
>
> * **Instance Type:** Enterprise Cloud or Enterprise Server
> * **Instance Hostname:** The hostname of your GitHub Enterprise instance (e.g. `github.mycompany.com`)
> * **Gateway:** The gateway connected to your private network (Enterprise Server only)
>
> Click **Connect to GitHub** when ready.
>
> **4. Install GitHub App**
>
> You will then be redirected to the GitHub App installation page.
>
> Install and authorize the GitHub application. This will redirect you back to Infisical's App Connections page.
>
> ![Install GitHub App](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/github/install-github-app.png)
>
> **5. Connection Created**
>
> Your **GitHub Connection** is now available for use.

> [tab] OAuth
>
> Infisical will use an OAuth App to connect to GitHub.
>
> > [accordion] Self-Hosted Instance
> >
> > Using the GitHub integration on a self-hosted instance of Infisical requires configuring an OAuth application in GitHub
> > and registering your instance with it.
> >
> > **1. Create an OAuth application in GitHub**
> >
> > Navigate to your user Settings > Developer settings > OAuth Apps to create a new GitHub OAuth application.
> >
> > ![integrations github config](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/github/integrations-github-config-settings.png)
> >
> > ![integrations github config](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/github/integrations-github-config-dev-settings.png)
> >
> > ![integrations github config](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/github/integrations-github-config-new-app.png)
> >
> > Create the OAuth application. As part of the form, set the **Homepage URL** to your self-hosted domain `https://your-domain.com`
> > and the **Authorization callback URL** to `https://your-domain.com/organization/app-connections/github/oauth/callback`.
> >
> > ![integrations github config](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/github/integrations-github-config-new-app-form.png)
> >
> > > [!NOTE]
> > >
> > > If you have a GitHub organization, you can create an OAuth application under it
> > > in your organization Settings > Developer settings > OAuth Apps > New Org OAuth App.
> >
> > **2. Add your OAuth application credentials to Infisical**
> >
> > Obtain the **Client ID** and generate a new **Client Secret** for your GitHub OAuth application.
> >
> > ![integrations github config](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/github/integrations-github-config-credentials.png)
> >
> > Back in your Infisical instance, add two new environment variables for the credentials of your GitHub OAuth application:
> >
> > * `INF_APP_CONNECTION_GITHUB_OAUTH_CLIENT_ID`: The **Client ID** of your GitHub OAuth application.
> > * `INF_APP_CONNECTION_GITHUB_OAUTH_CLIENT_SECRET`: The **Client Secret** of your GitHub OAuth application.
> >
> > Once added, restart your Infisical instance and use the GitHub integration.
>
> ## Setup GitHub connection in Infisical
>
> **1. Navigate to App Connections**
>
> Navigate to the **Integrations** tab in the desired project, then select **App Connections**.
>
> ![App Connections Tab](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/general/add-connection.png)
>
> **2. Add Connection**
>
> Select the **GitHub Connection** option from the connection options modal.
>
> ![Select GitHub Connection](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/github/select-github-connection.png)
>
> **3. Authorize Connection**
>
> Select the **OAuth** method and click **Connect to GitHub**.
>
> ![Connect via GitHub App](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/github/create-oauth-method.png)
>
> **4. Grant Access**
>
> Infisical redirects you to GitHub, which asks you to grant Infisical the `repo` and `admin:org` scopes. Together they cover every [type of GitHub secret](https://infisical.com/docs/integrations/secret-syncs/github.md#secret-types) a sync can write to, so you don't need to set any permissions yourself.
>
> After you grant access, GitHub redirects you back to Infisical's App Connections page.
>
> ![GitHub Authorization](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/github/integrations-github-auth.png)
>
> **5. Connection Created**
>
> Your **GitHub Connection** is now available for use.
>
> ![Assume Role AWS Connection](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/github/oauth-connection.png)

> [tab] Personal Access Token
>
> Infisical will use a Personal Access Token to connect to GitHub.
>
> ## Create a personal access token
>
> **1. Create a Personal Access Token in GitHub**
>
> Navigate to your user Settings > Developer settings > Personal Access Tokens to create a new Personal Access Token.
>
> ![integrations github config](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/github/integrations-github-config-settings.png)
>
> ![integrations github config](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/github/integrations-github-config-dev-settings.png)
>
> ![integrations github config](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/github/integrations-github-config-new-pat.png)
>
> Click **Generate new token** to create the token.
>
> **2. Fill in the Personal Access Token details**
>
> Fill in the Personal Access Token details:
>
> * **Token name:** A descriptive name for the token (for example, `infisical-connection-token`)
> * **Resource owner:** The user or organization that owns the repositories (select the organization to sync to an organization)
> * **Repository access:** **All repositories**, or **Only select repositories** to limit which repositories Infisical can manage secrets in
>
> Under **Permissions**, select **Add permissions** and add the permissions for every [type of GitHub secret](https://infisical.com/docs/integrations/secret-syncs/github.md#secret-types) you plan to sync:
>
> > [accordion] Actions secrets
> >
> > * To sync to a repository, set the repository permission **Secrets** to Read and write
> > * To sync to a repository environment, also set the repository permission **Environments** to Read and write, and **Actions** to Read-only
> > * To sync to an organization, set the organization permission **Secrets** to Read and write
> >
> > ![Secrets set to Read and write on a fine-grained personal access token](https://infisical.com/docs/images/app-connections/github/create-pat-form.png)
>
> > [accordion] Dependabot secrets
> >
> > * To sync to a repository, set the repository permission **Dependabot secrets** to Read and write
> > * To sync to an organization, set the organization permission **Organization dependabot secrets** to Read and write
> >
> > ![Dependabot secrets set to Read and write on a fine-grained personal access token](https://infisical.com/docs/images/app-connections/github/pat-dependabot-secrets-permission.png)
>
> > [accordion] Codespaces secrets
> >
> > GitHub Enterprise Server doesn't include Codespaces, so you can't sync Codespaces secrets through a GitHub Enterprise Server connection.
> >
> > * To sync to a repository, set the repository permission **Codespaces secrets** to Read and write
> > * To sync to an organization, set the organization permission **Organization codespaces secrets** to Read and write
> >
> > ![Codespaces secrets set to Read and write on a fine-grained personal access token](https://infisical.com/docs/images/app-connections/github/pat-codespaces-secrets-permission.png)
>
> Select **Generate token** to create the token.
>
> **3. Copy the Personal Access Token**
>
> Copy the generated token immediately as it won't be shown again.
>
> ![Personal Access Token Generated](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/github/create-pat-token-generated.png)
>
> > [!WARNING]
> >
> > Keep your Personal Access Token secure and do not share it. Anyone with access to this token can access your GitHub account and repositories.
>
> ## Setup GitHub connection in Infisical
>
> **1. Navigate to App Connections**
>
> Navigate to the **Integrations** tab in the desired project, then select **App Connections**.
>
> ![App Connections Tab](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/general/add-connection.png)
>
> **2. Add Connection**
>
> Select the **GitHub Connection** option from the connection options modal.
>
> ![Select GitHub Connection](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/github/select-github-connection.png)
>
> **3. Authorize Connection**
>
> Select the **Personal Access Token** method and fill in the **Personal Access Token** field with your Personal Access Token.
>
> You may optionally configure GitHub Enterprise options:
>
> * **Gateway:** The gateway connected to your private network
> * **Hostname:** The hostname at which to access your GitHub Enterprise instance
>
> Click **Create Connection**.
>
> ![Personal Access Token](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/github/create-pat-method.png)
>
> **4. Connection Created**
>
> Your **GitHub Connection** is now available for use.
>
> ![Personal Access Token Connection](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/github/pat-connection.png)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.