Choose a GitHub credential
Decide between GitHub App installation authority and GitHub user OAuth for your agent workload.
Constal supports two complementary GitHub CredentialProvider patterns. Both can use a tenant-owned GitHub App, but they represent different principals and should not be interchanged.
Comparison
| Question | GitHub App installation | GitHub user OAuth |
|---|---|---|
| Who acts? | The installed GitHub App | A specific GitHub user through the App |
| Best for | Background agents and automation | User-attributed actions |
| External authority | Selected repositories and App permissions | Intersection of App permissions and user access |
| Constal scope | Tenant or customer | Principal, sometimes customer |
| Bootstrap secret | App private key | App client secret |
| Output material | Short-lived installation token | User access token plus private refresh state |
| Browser authorization | No | Yes |
Use installation authority when
- the agent must continue when a user leaves;
- an organization selects repositories during App installation;
- operations should be attributed to the App;
- one Credential should represent one customer installation.
Continue with GitHub App installation credentials.
Use user OAuth when
- GitHub activity must be attributable to a person;
- effective authority must be constrained by that person's access;
- each user explicitly consents;
- a principal-scoped binding selects the user's grant.
Continue with GitHub user OAuth credentials.
Channel sign-in is separate
These CredentialProviders give agents outbound GitHub authority. They do not restrict who may invoke a Channel. A GitHub organization AuthProvider would authenticate the caller, verify organization membership, return identity evidence, and let Policy gate channel:receive and agent:invoke.
The authenticated principal or customer can then drive the scoped binding that selects one of these outbound Credentials.