How would I use gh with a Github app? #5095

kevincianfarini · 2022-01-25T02:41:33Z

kevincianfarini
Jan 25, 2022

I want to set up a PR bot by using gh with a Github app. Would I use a client secret when gh auth login --with-token?

Thanks!

Answered by mislav

Jan 28, 2022

I'm not sure what you refer to by a "client secret", but in essence yes, you can use gh from a GitHub App as long as you used the App to generate an authentication token for a user. You can either pass that token to gh auth login --with-token or you can set it to an environment variable, e.g. export GH_TOKEN="...".

View full answer

mislav · 2022-01-28T13:45:37Z

mislav
Jan 28, 2022

I'm not sure what you refer to by a "client secret", but in essence yes, you can use gh from a GitHub App as long as you used the App to generate an authentication token for a user. You can either pass that token to gh auth login --with-token or you can set it to an environment variable, e.g. export GH_TOKEN="...".

2 replies

kevincianfarini Jan 28, 2022
Author

Thanks!

kiefshemul-tomtom Sep 9, 2024

you can check the status of your auth just by gh auth status afterwards

dobesv · 2023-05-03T23:00:36Z

dobesv
May 3, 2023

Here's an example of how to generate a GITHUB_TOKEN in bash:

# If we have GitHub App credentials, this will set GITHUB_TOKEN and run gh auth setup-git which will make it
# so that git fetch, pull, and push will use it via the gh cli if the remote URL is https://github.com/
# GITHUB_APP_SECRET_PATH must be the path to the github app secret with the .pem file extension
# Dependencies:
#
# - [jwt-cli](https://github.com/mike-engel/jwt-cli)
# - [yq v3](https://github.com/mikefarah/yq/tree/v3.x)
# - curl
# - [gh](https://cli.github.com/)
#
# You can probably adjust this to use `jq` or the latest version of `yq` without too much trouble.

setup-gh-app-auth() {
  if [[ "${GITHUB_APP_ID}" != "" ]] && [[ -e "${GITHUB_APP_SECRET_PATH}" ]] ; then
    # Create a temporary JWT for API access
    GITHUB_JWT=$( jwt encode --secret "@${GITHUB_APP_SECRET_PATH}" -i "${GITHUB_APP_ID}" -e "10 minutes" --alg RS256 )
    # Request installation information; note that this assumes there's just one installation (this is a private GitHub app);
    # if you have multiple installations you'll have to customize this to p
8000
ick out the installation you are interested in    
    APP_TOKEN_URL=$( curl -s -H "Authorization: Bearer ${GITHUB_JWT}" -H "Accept: application/vnd.github.v3+json" https://api.github.com/app/installations | yq r - '[0].access_tokens_url' )
    # Now POST to the installation token URL to generate a new access token we can use to with with the gh and hub command lines
    export GITHUB_TOKEN=$( curl -s -X POST -H "Authorization: Bearer ${GITHUB_JWT}" -H "Accept: application/vnd.github.v3+json" ${APP_TOKEN_URL} | yq r - token )
    # Configure gh as an auth provider for git so we can use git push / pull / fetch with github.com URLs
    gh auth setup-git
  fi
}

Someone also published a more fancy looking script here in github: https://github.com/Link-/gh-token

1 reply

exp0nge Oct 10, 2024

Here's a slightly more portable version (no yq, jwt-cli needed, also assumes you send GITHUB_APP_INSTALLATION_ID to avoid one extra curl):

jwt_encode() {
  # https://stackoverflow.com/questions/58313106/create-rs256-jwt-in-bash
  PEM=$( cat "$GITHUB_APP_SECRET_PATH" )

  NOW=$( date +%s )
  IAT="${NOW}"
  # expire 5 minutes in the future. 10 minutes is the max for github
  EXP=$((${NOW} + 300))
  HEADER_RAW='{"alg":"RS256"}'
  HEADER=$( echo -n "${HEADER_RAW}" | openssl base64 | tr -d '=' | tr '/+' '_-' | tr -d '\n' )
  PAYLOAD_RAW='{"iat":'"${IAT}"',"exp":'"${EXP}"',"iss":'"${GITHUB_APP_ID}"'}'
  PAYLOAD=$( echo -n "${PAYLOAD_RAW}" | openssl base64 | tr -d '=' | tr '/+' '_-' | tr -d '\n' )
  HEADER_PAYLOAD="${HEADER}"."${PAYLOAD}"
  SIGNATURE=$( openssl dgst -sha256 -sign <(echo -n "${PEM}") <(echo -n "${HEADER_PAYLOAD}") | openssl base64 | tr -d '=' | tr '/+' '_-' | tr -d '\n' )
  GITHUB_JWT="${HEADER_PAYLOAD}"."${SIGNATURE}"
}

if [[ "${GITHUB_APP_ID}" != "" ]] && [[ -e "${GITHUB_APP_SECRET_PATH}" ]] ; then
  # Create a temporary JWT for API access
  jwt_encode
  # Request installation information; note that this assumes there's just one installation (this is a private GitHub app);
  # if you have multiple installations you'll have to customize this to pick out the installation you are interested in
  APP_TOKEN_URL="https://api.github.com/app/installations/${GITHUB_APP_INSTALLATION_ID}/access_tokens"
  # Now POST to the installation token URL to generate a new access token we can use to with with the gh and hub command lines
  export GITHUB_TOKEN=$( curl -s -X POST -H "Authorization: Bearer ${GITHUB_JWT}" -H "Accept: application/vnd.github.v3+json" ${APP_TOKEN_URL} | jq -r .token )
else
  echo "GITHUB_APP_ID and GITHUB_APP_SECRET_PATH must be set"
  exit 1
fi

vishu42 · 2023-07-29T05:56:12Z

vishu42
Jul 29, 2023

Here's a golang tool doing same thing, but can be run without any dependencies https://github.com/vishu42/github-token

8000

0 replies

filipliwinski · 2024-02-28T22:13:53Z

filipliwinski
Feb 28, 2024

You can find some official examples of how to generate JWT tokens in GitHub Docs:
Generating a JSON Web Token (JWT) for a GitHub App

Note that this is not the actual token that you should use to authenticate to GitHub CLI as an app. See About authentication with a GitHub App

0 replies

wherka-ama · 2025-12-03T07:24:29Z

wherka-ama
Dec 3, 2025

Hello,
if anyone here is still interested in this topic I might have some good news.

I've been working on a GitHub CLI extension that solves a common pain point: managing Git authentication across multiple organizations.

Key features:

🔐 GitHub App authentication - No more long-lived PATs for CI/CD
🔀 Pattern-based routing - Different credentials for different repos/orgs (technically they are not really patterns, more like a hierarchy based approach - org or org/repo)
🔑 PAT support - Mix GitHub Apps with PATs when needed
🏢 Multi-org friendly - Works seamlessly with submodules across orgs
🔒 Secure storage - Encrypted credentials with automatic token caching

Install:

gh extension install AmadeusITGroup/gh-app-auth

Here's the repo:
📦 https://github.com/AmadeusITGroup/gh-app-auth

It is written in GO, released under Apache and all kinds of contributions are welcome.

It's still early days - there may be bugs and rough edges I haven't discovered yet. Would love your feedback, issues, or PRs! 🙏

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

How would I use gh with a Github app? #5095

Uh oh!

{{title}}

Uh oh!

Replies: 5 comments 3 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

How would I use gh with a Github app? #5095

Uh oh!

Replies: 5 comments · 3 replies

Uh oh!

Uh oh!

kevincianfarini Jan 28, 2022 Author

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Replies: 5 comments 3 replies

kevincianfarini Jan 28, 2022
Author