GitHub sign-in

A step of the Cloud application tree on Gradus, in the Security area: Secrets, auth, TLS, input.

Let users sign in with GitHub, which is plain OAuth rather than OIDC: no ID token, and the address comes from a separate call.

Usually comes after: Sign-in flow.

Leads to: More providers.

Prompt for your AI assistant

Read the sign-in decision record in docs/decisions. Add Sign in with GitHub. On a hosted provider, turn on its GitHub connection with an OAuth app of this product's own and check that its account linking follows the rule below. In your own service, use a maintained library for the OAuth authorization code flow and check the state. GitHub login is OAuth, not OIDC, so there is no ID token: take the numeric user id from the API as the subject, because a login name can change, and read addresses from the user emails endpoint, because the public profile may show none. Use only the primary address marked verified, and link to an existing user only when that identity is verified too. Otherwise ask the user to sign in first and link from settings. Test with a real account whose address is private.

This is https://gradus.kazet.blog/tree/cloud-application/step/github-sign-in as plain HTML. In a browser the page also lets you mark the step forged and copy a message for your AI assistant.