{"meta":{"title":"Авторизация приложений OAuth","intro":"Вы можете разрешить другим пользователям авторизовать данные OAuth app.","product":"Приложения","breadcrumbs":[{"href":"/ru/apps","title":"Приложения"},{"href":"/ru/apps/oauth-apps","title":"Приложения OAuth"},{"href":"/ru/apps/oauth-apps/building-oauth-apps","title":"Создание приложений OAuth"},{"href":"/ru/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps","title":"Авторизация приложений OAuth"}],"documentType":"article"},"body":"# Авторизация приложений OAuth\n\nВы можете разрешить другим пользователям авторизовать данные OAuth app.\n\n<!-- TRANSLATION_FALLBACK prop=markdown type=ParseError line=366 col=106 msg=\"tag 'endif' not found\" -->\n> \\[!NOTE]\n> Consider building a GitHub App instead of an OAuth app.\n>\n> Both OAuth apps and GitHub Apps use OAuth 2.0.\n>\n> GitHub Apps can act on behalf of a user, similar to an OAuth app, or as themselves, which is beneficial for automations that do not require user input. Additionally, GitHub Apps use fine-grained permissions, give the user more control over which repositories the app can access, and use short-lived tokens. For more information, see [Differences between GitHub Apps and OAuth apps](/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps) and [About creating GitHub Apps](/en/apps/creating-github-apps/about-creating-github-apps/about-creating-github-apps).\n\nGitHub's OAuth implementation supports the standard [authorization code grant type](https://tools.ietf.org/html/rfc6749#section-4.1) and the OAuth 2.0 [Device Authorization Grant](https://tools.ietf.org/html/rfc8628) for apps that don't have access to a web browser.\n\nIf you want to skip authorizing your app in the standard way, such as when testing your app, you can use the [non-web application flow](#non-web-application-flow).\n\nTo authorize your OAuth app, consider which authorization flow best fits your app.\n\n* [web application flow](#web-application-flow): Used to authorize users for standard OAuth apps that run in the browser. (The [implicit grant type](https://tools.ietf.org/html/rfc6749#section-4.2) is not supported.)\n* [device flow](#device-flow): Used for headless apps, such as CLI tools.\n\n## Expiring access tokens\n\nTo enforce regular token rotation and reduce the impact of a compromised token, you can configure your OAuth app to get access tokens that expire. When your app uses access tokens that expire, you will also receive a refresh token with your access token. Both the web application flow and the device flow support expiring tokens.\n\nThe access token expires after eight hours, and the refresh token expires after six months without use. You can use the refresh token to generate a new access token and a new refresh token. For more information, see [Refreshing an access token with a refresh token](#refreshing-an-access-token-with-a-refresh-token).\n\n### Opting in to expiring tokens at runtime\n\nTo test and gradually roll out support for expiring tokens, you can opt in to receive an expiring token and a refresh token for an individual sign-in by requesting the `offline_access` scope in addition to your other scopes. When you request the `offline_access` scope, you will receive an expiring access token and a refresh token even if your app is not configured to use expiring tokens.\n\nIf your app supports both GitHub Enterprise Server and GitHub.com, you should be prepared for the `offline_access` scope to have no effect, because the GitHub Enterprise Server instance may not yet support expiring tokens. In this case, you will receive a non-expiring token and no refresh token, so your app should not assume that a refresh token is always returned.\n\n### Requiring expiring tokens for your app\n\nOnce you have updated your app to use refresh tokens to handle token expiration, you can force token expiration for your app globally. This will cause all new tokens to be issued with an expiration and refresh token. Enabling this feature does not cause existing tokens to expire—they will continue to be long-lived. If you want to switch to expiring tokens, have the user sign in again. To configure this setting for your app, see [Activating optional features for OAuth apps](/en/apps/oauth-apps/maintaining-oauth-apps/activating-optional-features-for-oauth-apps).\n\n## Web application flow\n\n> \\[!NOTE]\n> If you are building a GitHub App, you can still use the OAuth web application flow, but the setup has some important differences. See [Authenticating with a GitHub App on behalf of a user](/en/apps/creating-github-apps/authenticating-with-a-github-app/authenticating-with-a-github-app-on-behalf-of-a-user) for more information.\n\nThe web application flow to authorize users for your app is:\n\n1. Users are redirected to request their GitHub identity\n2. Users are redirected back to your site by GitHub\n3. Your app accesses the API with the user's access token\n\n### 1. Request a user's GitHub identity\n\n```\nGET https://github.com/login/oauth/authorize\n```\n\nThis endpoint takes the following input parameters.\n\n| Query parameter         | Type     | Required?            | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |\n| ----------------------- | -------- | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `client_id`             | `string` | Required             | The client ID you received from GitHub when you [registered](https://github.com/settings/applications/new).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |\n| `redirect_uri`          | `string` | Strongly recommended | The URL in your application where users will be sent after authorization. See details below about [redirect urls](#redirect-urls).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |\n| `login`                 | `string` | Optional             | Suggests a specific account to use for signing in and authorizing the app.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |\n| `scope`                 | `string` | Context dependent    | A space-delimited list of [scopes](/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps). If not provided, `scope` defaults to an empty list for users that have not authorized any scopes for the application. For users who have authorized scopes for the application, the user won't be shown the OAuth authorization page with the list of scopes. Instead, this step of the flow will automatically complete with the set of scopes the user has authorized for the application. For example, if a user has already performed the web flow twice and has authorized one token with `user` scope and another token with `repo` scope, a third web flow that does not provide a `scope` will receive a token with `user` and `repo` scope. Use of the `offline_access` scope to get an expiring token will not alter the scope behavior—it is not tracked as a typical scope like `repo` or `user`, and will not cause additional prompts to appear if used. |\n| `state`                 | `string` | Strongly recommended | An unguessable random string. It is used to protect against cross-site request forgery attacks.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |\n|                         |          |                      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |\n| `code_challenge`        | `string` | Strongly recommended | Used to secure the authentication flow with PKCE (Proof Key for Code Exchange). Required if `code_challenge_method` is included. Must be a 43 character SHA-256 hash of a random string generated by the client. See the [PKCE RFC](https://datatracker.ietf.org/doc/html/rfc7636) for more details about this security extension.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |\n| `code_challenge_method` | `string` | Strongly recommended | Used to secure the authentication flow with PKCE (Proof Key for Code Exchange). Required if `code_challenge` is included. Must be `S256` - the `plain` code challenge method is not supported.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |\n|                         |          |                      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |\n| `allow_signup`          | `string` | Optional             | Whether or not unauthenticated users will be offered an option to sign up for GitHub during the OAuth flow. The default is `true`. Use `false` when a policy prohibits signups.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |\n| `prompt`                | `string` | Optional             | Forces the account picker to appear if set to `select_account`. The account picker will also appear if the application has a non-HTTP redirect URI or if the user has multiple accounts signed in.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |\n\nCORS pre-flight requests (OPTIONS) are not supported at this time.\n\n### 2. Users are redirected back to your site by GitHub\n\nIf the user accepts your request, GitHub redirects back to your site with a temporary `code` in a code parameter as well as the state you provided in the previous step in a `state` parameter. The temporary code will expire after 10 minutes. If the states don't match, then a third party created the request, and you should abort the process.\n\nExchange this `code` for an access token:\n\n```\nPOST https://github.com/login/oauth/access_token\n```\n\nThis endpoint takes the following input parameters.\n\n| Parameter name  | Type     | Required?            | Description                                                                                                                                                                                                                                                                                                                                                                                                    |\n| --------------- | -------- | -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `client_id`     | `string` | Required             | The client ID you received from GitHub for your OAuth app.                                                                                                                                                                                                                                                                                                                                                     |\n| `client_secret` | `string` | Required             | The client secret you received from GitHub for your OAuth app.                                                                                                                                                                                                                                                                                                                                                 |\n| `code`          | `string` | Required             | The code you received as a response to Step 1.                                                                                                                                                                                                                                                                                                                                                                 |\n| `redirect_uri`  | `string` | Strongly recommended | The URL in your application where users are sent after authorization. We can use this to match against the URI originally provided when the `code` was issued, to prevent attacks against your service.                                                                                                                                                                                                        |\n|                 |          |                      |                                                                                                                                                                                                                                                                                                                                                                                                                |\n| `code_verifier` | `string` | Strongly recommended | Used to secure the authentication flow with PKCE (Proof Key for Code Exchange). Required if `code_challenge` was sent during the user authorization. Must be the original value used to generate the `code_challenge` in the authorization request. This can be stored in a cookie alongside the `state` parameter or in a session variable during authentication, depending on your application architecture. |\n|                 |          |                      |                                                                                                                                                                                                                                                                                                                                                                                                                |\n\nBy default, the response takes the following form:\n\n```shell\naccess_token=gho_16C7e42F292c6912E7710c838347Ae178B4a\n&scope=repo%2Cgist\n&token_type=bearer\n```\n\nYou can also receive the response in different formats if you provide the format in the `Accept` header. For example, `Accept: application/json` or `Accept: application/xml`:\n\n```json\nAccept: application/json\n{\n  \"access_token\":\"gho_16C7e42F292c6912E7710c838347Ae178B4a\",\n  \"scope\":\"repo,gist\",\n  \"token_type\":\"bearer\"\n}\n```\n\n```xml\nAccept: application/xml\n<OAuth>\n  <token_type>bearer</token_type>\n  <scope>repo,gist</scope>\n  <access_token>gho_16C7e42F292c6912E7710c838347Ae178B4a</access_token>\n</OAuth>\n```\n\nIf your OAuth app uses expiring access tokens, or if you requested the `offline_access` scope, the response also includes a `refresh_token`, along with the `expires_in` and `refresh_token_expires_in` values that indicate when each token expires (as seconds from the current time). For more information, see [Expiring access tokens](#expiring-access-tokens).\n\nBy default, the response takes the following form:\n\n```shell\naccess_token=gho_16C7e42F292c6912E7710c838347Ae178B4a\n&expires_in=28800\n&refresh_token=ghr_1B4a2e77838347a7E420ce178F2E7c6912E169246c34E1ccbF66C46812d16D5B1A9Dc86A1498\n&refresh_token_expires_in=15897600\n&scope=repo%2Cgist\n&token_type=bearer\n```\n\n### 3. Use the access token to access the API\n\nThe access token allows you to make requests to the API on a behalf of a user.\n\n```\nAuthorization: Bearer OAUTH-TOKEN\nGET https://api.github.com/user\n```\n\nFor example, in curl you can set the Authorization header like this:\n\n```shell\ncurl -H \"Authorization: Bearer OAUTH-TOKEN\" https://api.github.com/user\n```\n\nEvery time you receive an access token, you should use the token to revalidate the user's identity. A user can change which account they are signed into when you send them to authorize your app, and you risk mixing user data if you do not validate the user's identity after every sign in.\n\n## Device flow\n\nThe device flow allows you to authorize users for a headless application, such as a CLI tool or the [Git Credential Manager](https://github.com/git-ecosystem/git-credential-manager).\n\nBefore you can use the device flow to authorize and identify users, you must first enable it in your app's settings. For more information about enabling the device flow in your app, see [Modifying a GitHub App registration](/en/apps/maintaining-github-apps/modifying-a-github-app-registration) for GitHub Apps and [Modifying an OAuth app](/en/apps/oauth-apps/maintaining-oauth-apps/modifying-an-oauth-app) for OAuth apps.\n\n### Overview of the device flow\n\n1. Your app requests device and user verification codes and gets the authorization URL where the user will enter the user verification code.\n2. The app prompts the user to enter a user verification code at  [`https://github.com/login/device`](https://github.com/login/device).\n3. The app polls for the user authentication status. Once the user has authorized the device, the app will be able to make API calls with a new access token.\n\n### Step 1: App requests the device and user verification codes from GitHub\n\n```\nPOST https://github.com/login/device/code\n```\n\nYour app must request a user verification code and verification URL that the app will use to prompt the user to authenticate in the next step. This request also returns a device verification code that the app must use to receive an access token and check the status of user authentication.\n\nThe endpoint takes the following input parameters.\n\n| Parameter name | Type     | Description                                                                                                                                                                                   |\n| -------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `client_id`    | `string` | **Required.** The client ID you received from GitHub for your app.                                                                                                                            |\n| `scope`        | `string` | A space-delimited list of the scopes that your app is requesting access to. For more information, see [Scopes for OAuth apps](/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps). |\n\nBy default, the response takes the following form:\n\n```shell\ndevice_code=3584d83530557fdd1f46af8289938c8ef79f9dc5\n&expires_in=900\n&interval=5\n&user_code=WDJB-MJHT\n&verification_uri=https%3A%2F%2Fgithub.com%2Flogin%2Fdevice\n```\n\n| Parameter name     | Type      | Description                                                                                                                                                                                                                                                                                                                                                                                            |\n| ------------------ | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |\n| `device_code`      | `string`  | The device verification code is 40 characters and used to verify the device.                                                                                                                                                                                                                                                                                                                           |\n| `user_code`        | `string`  | The user verification code is displayed on the device so the user can enter the code in a browser. This code is 8 characters with a hyphen in the middle.                                                                                                                                                                                                                                              |\n| `verification_uri` | `string`  | The verification URL where users need to enter the `user_code`:  [`https://github.com/login/device`](https://github.com/login/device).                                                                                                                                                                                                                                                                 |\n| `expires_in`       | `integer` | The number of seconds before the `device_code` and `user_code` expire. The default is 900 seconds or 15 minutes.                                                                                                                                                                                                                                                                                       |\n| `interval`         | `integer` | The minimum number of seconds that must pass before you can make a new access token request (`POST https://github.com/login/oauth/access_token`) to complete the device authorization. For example, if the interval is 5, then you cannot make a new request until 5 seconds pass. If you make more than one request over 5 seconds, then you will hit the rate limit and receive a `slow_down` error. |\n\nYou can also receive the response in different formats if you provide the format in the `Accept` header. For example, `Accept: application/json` or `Accept: application/xml`:\n\n```json\nAccept: application/json\n{\n  \"device_code\": \"3584d83530557fdd1f46af8289938c8ef79f9dc5\",\n  \"user_code\": \"WDJB-MJHT\",\n  \"verification_uri\": \"https://github.com/login/device\",\n  \"expires_in\": 900,\n  \"interval\": 5\n}\n```\n\n```xml\nAccept: application/xml\n<OAuth>\n  <device_code>3584d83530557fdd1f46af8289938c8ef79f9dc5</device_code>\n  <user_code>WDJB-MJHT</user_code>\n  <verification_uri>https://github.com/login/device</verification_uri>\n  <expires_in>900</expires_in>\n  <interval>5</interval>\n</OAuth>\n```\n\n### Step 2: Prompt the user to enter the user code in a browser\n\nYour device will show the user verification code and prompt the user to enter the code at  [`https://github.com/login/device`](https://github.com/login/device).\n\n### Step 3: App polls GitHub to check if the user authorized the device\n\n```\nPOST https://github.com/login/oauth/access_token\n```\n\nYour app will make device authorization requests that poll `POST https://github.com/login/oauth/access_token`, until the device and user codes expire or the user has successfully authorized the app with a valid user code. The app must use the minimum polling `interval` retrieved in step 1 to avoid rate limit errors. For more information, see [Rate limits for the device flow](#rate-limits-for-the-device-flow).\n\nThe user must enter a valid code within 15 minutes (or 900 seconds). After 15 minutes, you will need to request a new device authorization code with `POST https://github.com/login/device/code`.\n\nOnce the user has authorized, the app will receive an access token that can be used to make requests to the API on behalf of a user.\n\nThe endpoint takes the following input parameters.\n\n| Parameter name | Type     | Description                                                                                                |\n| -------------- | -------- | ---------------------------------------------------------------------------------------------------------- |\n| `client_id`    | `string` | **Required.** The client ID you received from GitHub for your OAuth app.                                   |\n| `device_code`  | `string` | **Required.** The `device_code` you received from the `POST https://github.com/login/device/code` request. |\n| `grant_type`   | `string` | **Required.** The grant type must be `urn:ietf:params:oauth:grant-type:device_code`.                       |\n\nBy default, the response takes the following form:\n\n```shell\naccess_token=gho_16C7e42F292c6912E7710c838347Ae178B4a\n&token_type=bearer\n&scope=repo%2Cgist\n```\n\nYou can also receive the response in different formats if you provide the format in the `Accept` header. For example, `Accept: application/json` or `Accept: application/xml`:\n\n```json\nAccept: application/json\n{\n \"access_token\": \"gho_16C7e42F292c6912E7710c838347Ae178B4a\",\n  \"token_type\": \"bearer\",\n  \"scope\": \"repo,gist\"\n}\n```\n\n```xml\nAccept: application/xml\n<OAuth>\n  <access_token>gho_16C7e42F292c6912E7710c838347Ae178B4a</access_token>\n  <token_type>bearer</token_type>\n  <scope>gist,repo</scope>\n</OAuth>\n```\n\nIf your OAuth app uses expiring access tokens, or if you requested the `offline_access` scope, the response also includes a `refresh_token`, along with the `expires_in` and `refresh_token_expires_in` values that indicate when each token expires. For more information, see [Expiring access tokens](#expiring-access-tokens).\n\n```shell\naccess_token=gho_16C7e42F292c6912E7710c838347Ae178B4a\n&expires_in=28800\n&refresh_token=ghr_1B4a2e77838347a7E420ce178F2E7c6912E169246c34E1ccbF66C46812d16D5B1A9Dc86A1498\n&refresh_token_expires_in=15897600\n&token_type=bearer\n&scope=repo%2Cgist\n```\n\n### Rate limits for the device flow\n\nWhen a user submits the verification code on the browser, there is a rate limit of 50 submissions in an hour per application.\n\nIf you make more than one access token request (`POST https://github.com/login/oauth/access_token`) within the required minimum timeframe between requests (or `interval`), you'll hit the rate limit and receive a `slow_down` error response. The `slow_down` error response adds 5 seconds to the last `interval`. For more information, see the [Error codes for the device flow](#error-codes-for-the-device-flow).\n\n### Error codes for the device flow\n\n| Error code                     | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |\n| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `authorization_pending`        | This error occurs when the authorization request is pending and the user hasn't entered the user code yet. The app is expected to keep polling the `POST https://github.com/login/oauth/access_token` request without exceeding the `interval`, which requires a minimum number of seconds between each request.                                                                                                                                                                                  |\n| `slow_down`                    | When you receive the `slow_down` error, 5 extra seconds are added to the minimum `interval` or timeframe required between your requests using `POST https://github.com/login/oauth/access_token`. For example, if the starting interval required at least 5 seconds between requests and you get a `slow_down` error response, you must now wait a minimum of 10 seconds before making a new request for an OAuth access token. The error response includes the new `interval` that you must use. |\n| `expired_token`                | If the device code expired, then you will see the `token_expired` error. You must make a new request for a device code.                                                                                                                                                                                                                                                                                                                                                                           |\n| `unsupported_grant_type`       | The grant type must be `urn:ietf:params:oauth:grant-type:device_code` and included as an input parameter when you poll the OAuth token request `POST https://github.com/login/oauth/access_token`.                                                                                                                                                                                                                                                                                                |\n| `incorrect_client_credentials` | For the device flow, you must pass your app's client ID, which you can find on your app settings page. The `client_secret` is not needed for the device flow.                                                                                                                                                                                                                                                                                                                                     |\n| `incorrect_device_code`        | The device\\_code provided is not valid.                                                                                                                                                                                                                                                                                                                                                                                                                                                           |\n| `access_denied`                | When a user clicks cancel during the authorization process, you'll receive a `access_denied` error and the user won't be able to use the verification code again.                                                                                                                                                                                                                                                                                                                                 |\n| `device_flow_disabled`         | Device flow has not been enabled in the app's settings. For more information, see [Device flow](#device-flow).                                                                                                                                                                                                                                                                                                                                                                                    |\n\nFor more information, see the [OAuth 2.0 Device Authorization Grant](https://tools.ietf.org/html/rfc8628#section-3.5).\n\n## Refreshing an access token with a refresh token\n\nIf your OAuth app uses expiring access tokens, you can use the refresh token to generate a new access token and a new refresh token. Once you use a refresh token, that refresh token and the old access token will no longer work. For more information about expiring tokens, see [Expiring access tokens](#expiring-access-tokens).\n\nIf your refresh token expires before you use it, you must send the user through the web application flow or device flow again to get a new token pair.\n\nTo refresh an access token, make a `POST` request to the following URL, along with the input parameters below.\n\n```\nPOST https://github.com/login/oauth/access_token\n```\n\n| Parameter name  | Type     | Required?                                                     | Description                                                        |\n| --------------- | -------- | ------------------------------------------------------------- | ------------------------------------------------------------------ |\n| `client_id`     | `string` | Required                                                      | The client ID you received from GitHub for your OAuth app.         |\n| `client_secret` | `string` | Required unless the token was generated using the device flow | The client secret you received from GitHub for your OAuth app.     |\n| `grant_type`    | `string` | Required                                                      | The value must be `refresh_token`.                                 |\n| `refresh_token` | `string` | Required                                                      | The refresh token you received when you generated an access token. |\n\nBy default, the response takes the following form:\n\n```shell\naccess_token=gho_16C7e42F292c6912E7710c838347Ae178B4a\n&expires_in=28800\n&refresh_token=ghr_1B4a2e77838347a7E420ce178F2E7c6912E169246c34E1ccbF66C46812d16D5B1A9Dc86A1498\n&refresh_token_expires_in=15897600\n&scope=repo%2Cgist\n&token_type=bearer\n```\n\nThe scopes on the new access token will match the scopes of the previous token. You cannot provide a `scope` parameter during token refresh in order to change the access of the resulting token.\n\nIf the refresh token that you specified is invalid or expired, you will receive a `bad_refresh_token` error. To resolve this error, send the user through the web application flow or device flow again to get a new access token and refresh token.\n\n## Non-Web application flow\n\nNon-web authentication is available for limited situations like testing. If you need to, you can use [Basic Authentication](/en/rest/authentication/authenticating-to-the-rest-api#using-basic-authentication) to create a personal access token using your [personal access tokens settings page](/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens). This technique enables the user to revoke access at any time.\n\n## Redirect URLs\n\nThe `redirect_uri` parameter is optional. If left out, GitHub will\nredirect users to the first callback URL configured in the OAuth app\nsettings.\n\nIf required, you may enable wildcard matching for a callback URL. When wildcard matching is enabled, the redirect URL's host (excluding subdomains) and port must exactly match the callback URL, and the redirect URL's path must reference a subdirectory of the callback URL. This means that any subdomain or subdirectory of the callback URL will match and be allowed as a callback URL. For example, if wildcard matching is enabled for the callback URL `https://example.com/path`:\n\n```\nCALLBACK: https://example.com/path\n\nMATCH: https://example.com/path\nMATCH: https://example.com/path/subdir/other\nMATCH: https://oauth.example.com/path\nMATCH: https://oauth.example.com/path/subdir/other\nFAIL:  https://example.com/bar\nFAIL:  https://example.com/\nFAIL:  https://example.com:8080/path\nFAIL:  https://oauth.example.com:8080/path\nFAIL:  https://example.org\n```\n\nWhen wildcard matching is disabled, the redirect URL must exactly match the callback URL. You can enable or disable wildcard matching for each callback URL in your app's settings.\n\n> \\[!WARNING]\n> Enabling wildcard matching can expose your app to security risks, because it allows an attacker to send authorization codes to any subdomain or subdirectory of the callback URL. Only enable wildcard matching if you absolutely need it and you are entirely certain that you control all possible subdomains and paths of the callback URL. For more information, see the [OAuth 2.0 Security Best Current Practice](https://www.rfc-editor.org/info/rfc9700/#section-4.1.1-11).\n\nApps that had a single callback URL enabled prior to August 3, 2026 have wildcard matching enabled for that callback URL. This preserves the redirect behavior that existed before wildcard matching became a configurable setting, and is why all OAuth apps and some GitHub Apps created before that date have wildcard matching enabled. If your app does not need wildcard matching, we recommend that you disable it.\n\n### Loopback redirect urls\n\nThe optional `redirect_uri` parameter can also be used for loopback URLs, which is useful for native applications running on a desktop computer. If the application specifies a loopback URL and a port, then after authorizing the application users will be redirected to the provided URL and port. The `redirect_uri` does not need to match the port specified in the callback URL for the app.\n\nFor the `http://127.0.0.1/path` callback URL, you can use this `redirect_uri` if your application is listening on port `1234`:\n\n```http\nhttp://127.0.0.1:1234/path\n```\n\nNote that OAuth RFC [recommends not to use `localhost`](https://datatracker.ietf.org/doc/html/rfc8252#section-7.3), but instead to use loopback literal `127.0.0.1` or IPv6 `::1`.\n\n## Creating multiple tokens for OAuth apps\n\nYou can create multiple tokens for a user/application/scope combination to create tokens for specific use cases.\n\nThis is useful if your OAuth app supports one workflow that uses GitHub for sign-in and only requires basic user information. Another workflow may require access to a user's private repositories. Using multiple tokens, your OAuth app can perform the web flow for each use case, requesting only the scopes needed. If a user only uses your application to sign in, they are never required to grant your OAuth app access to their private repositories.\n\nThere is a limit of ten tokens that are issued per user/application/scope combination, and a rate limit of ten tokens created per hour. If an application creates more than ten tokens for the same user and the same scopes, GitHub revokes one of the existing tokens with the same user/application/scope combination, chosen in this order:\n\n1. The oldest token that has never been used and that was created more than one minute ago. Tokens created within the last minute are usually protected, so that an application has time to use a token it has just created.\n2. If there is no such token, but at least one token has been used, the token that was least recently used.\n3. If no token has ever been used, the oldest token, even if it was created within the last minute.\n\nHitting the hourly rate limit will not revoke your oldest token. Instead, it will trigger a re-authorization prompt within the browser, asking the user to double check the permissions they're granting your app. This prompt is intended to give a break to any potential infinite loop the app is stuck in, since there's little to no reason for an app to request ten tokens from the user within an hour.\n\n> \\[!WARNING]\n> Revoking all permission from an OAuth app deletes any SSH keys the application generated on behalf of the user, including [deploy keys](/en/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys).\n\n## Directing users to review their access\n\nYou can link to authorization information for an OAuth app so that users can review and revoke their application authorizations.\n\nTo build this link, you'll need your OAuth app's `client_id` that you received from GitHub when you registered the application.\n\n```http\nhttps://github.com/settings/connections/applications/:client_id\n```\n\n> \\[!TIP]\n> To learn more about the resources that your OAuth app can access for a user, see [Discovering resources for a user](/en/rest/guides/discovering-resources-for-a-user).\n\n## Troubleshooting\n\n* [Troubleshooting authorization request errors](/en/apps/oauth-apps/maintaining-oauth-apps/troubleshooting-authorization-request-errors)\n* [Troubleshooting OAuth app access token request errors](/en/apps/oauth-apps/maintaining-oauth-apps/troubleshooting-oauth-app-access-token-request-errors)\n* [Device flow errors](#error-codes-for-the-device-flow)\n* [Token expiration and revocation](/en/authentication/keeping-your-account-and-data-secure/token-expiration-and-revocation)\n\n## Further reading\n\n* [About authentication to GitHub](/en/authentication/keeping-your-account-and-data-secure/about-authentication-to-github)"}