# Github Oauth Nango Integration

Use when implementing GitHub OAuth + GitHub App authentication with Nango - provides...

- Repository: https://github.com/AgentWorkforce/relay (1088 stars)
- Category: Git and review
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add AgentWorkforce/relay --skill github-oauth-nango-integration -g -a claude-code -y`
Codex: `npx skills add AgentWorkforce/relay --skill github-oauth-nango-integration -g -a codex -y`
Cursor: `npx skills add AgentWorkforce/relay --skill github-oauth-nango-integration -g -a cursor -y`
Gemini CLI: `npx skills add AgentWorkforce/relay --skill github-oauth-nango-integration -g -a gemini-cli -y`

## Description

Use when implementing GitHub OAuth + GitHub App authentication with Nango - provides two-connection pattern for user login and repo access with webhook handling

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# GitHub OAuth + Nango Integration

## Overview

Implements dual-connection OAuth pattern: one for user identity (`github` integration), another for repository access (`github-app-oauth` integration). This separation enables secure login while maintaining granular repo permissions through GitHub App installations.

## When to Use

- Setting up GitHub OAuth login via Nango
- Implementing GitHub App installation webhooks
- Reconciling OAuth users with GitHub App installations
- Building apps that need both user auth and repo access
- Handling Nango sync webhooks for GitHub data

## Why Two Connections?

GitHub has **two different authentication mechanisms** that serve different purposes:

### GitHub OAuth App (`github` integration)

- **What it is**: Traditional OAuth for user identity
- **What it gives you**: User profile (name, email, avatar, GitHub ID)
- **What it DOESN'T give you**: Access to repositories
- **Use for**: Login, "Sign in with GitHub"

### GitHub App (`github-app-oauth` integration)

- **What it is**: Installable app with granular repo permissions
- **What it gives you**: Access to specific repos the user installed it on
- **What it DOESN'T give you**: User identity (it knows the installation, not who's using it)
- **Use for**: Reading PRs, commits, files; posting comments; webhooks

### The Reconciliation Problem

```
OAuth App alone:  "User john@example.com logged in" → but which repos can they access?
GitHub App alone: "Installation #12345 has access to repo X" → but who is the user?
```

**Solution**: Two separate OAuth flows linked by user ID:

1. **Login flow** → User authenticates → Store user identity + `nangoConnectionId`
2. **Repo flow** → Same user authorizes app → Store repos + link via `ownerId`

This lets you answer: "User john@example.com can access repos X, Y, Z"

## Quick Reference

The rest: https://github.com/AgentWorkforce/relay/blob/HEAD/.claude/skills/github-oauth-nango-integration/SKILL.md