# Choose a GitHub credential

> Decide between GitHub App installation authority and GitHub user OAuth for your agent workload.

Constal supports two complementary GitHub CredentialProvider patterns. Both can use a tenant-owned GitHub App, but they represent different principals and should not be interchanged.

## Comparison {#comparison}

| Question | GitHub App installation | GitHub user OAuth |
| --- | --- | --- |
| Who acts? | The installed GitHub App | A specific GitHub user through the App |
| Best for | Background agents and automation | User-attributed actions |
| External authority | Selected repositories and App permissions | Intersection of App permissions and user access |
| Constal scope | Tenant or customer | Principal, sometimes customer |
| Bootstrap secret | App private key | App client secret |
| Output material | Short-lived installation token | User access token plus private refresh state |
| Browser authorization | No | Yes |

## Use installation authority when {#use-installation}

- the agent must continue when a user leaves;
- an organization selects repositories during App installation;
- operations should be attributed to the App;
- one Credential should represent one customer installation.

Continue with [GitHub App installation credentials](/docs/credentials/integrations/github/github-app.md).

## Use user OAuth when {#use-user-oauth}

- GitHub activity must be attributable to a person;
- effective authority must be constrained by that person's access;
- each user explicitly consents;
- a principal-scoped binding selects the user's grant.

Continue with [GitHub user OAuth credentials](/docs/credentials/integrations/github/github-user-oauth.md).

## Channel sign-in is separate {#channel-sign-in}

These CredentialProviders give agents outbound GitHub authority. They do not restrict who may invoke a Channel. A GitHub organization AuthProvider would authenticate the caller, verify organization membership, return identity evidence, and let Policy gate `channel:receive` and `agent:invoke`.

The authenticated principal or customer can then drive the scoped binding that selects one of these outbound Credentials.