GitHub OAuth + Nango Integration

Overview

Implements dual-connection OAuth pattern: one for user identity (github integration), another for repository access (github-app-oauth integration). This separation enables secure login while maintaining granular repo permissions through GitHub App installations.

When to Use

• Setting up GitHub OAuth login via Nango
• Implementing GitHub App installation webhooks
• Reconciling OAuth users with GitHub App installations
• Building apps that need both user auth and repo access
• Handling Nango sync webhooks for GitHub data

Why Two Connections?

GitHub has two different authentication mechanisms that serve different purposes:

GitHub OAuth App (github integration)

• What it is: Traditional OAuth for user identity
• What it gives you: User profile (name, email, avatar, GitHub ID)
• What it DOESN'T give you: Access to repositories
• Use for: Login, "Sign in with GitHub"

GitHub App (github-app-oauth integration)

• What it is: Installable app with granular repo permissions
• What it gives you: Access to specific repos the user installed it on
• What it DOESN'T give you: User identity (it knows the installation, not who's using it)
• Use for: Reading PRs, commits, files; posting comments; webhooks

The Reconciliation Problem

OAuth App alone:  "User john@example.com logged in" → but which repos can they access?
GitHub App alone: "Installation #12345 has access to repo X" → but who is the user?

Solution: Two separate OAuth flows linked by user ID:

1. Login flow → User authenticates → Store user identity + nangoConnectionId
2. Repo flow → Same user authorizes app → Store repos + link via ownerId

This lets you answer: "User john@example.com can access repos X, Y, Z"

Quick Reference