Read-Only OAuth Scope

[choonkeat]

Details are all jollygoodcode/jollygoodcode.github.io#6

As a user, I would like all apps to only require the lowest level of permission that it needs to operate.
As a developer, I am taking on unnecessary liability when my app has permissions that it doesn't need.

By design, GitHub API does not provide any Read-only OAuth scope for public and/or private repos. Once you ask for permissions to either public and/or private repos, you'll get both read and write. What can we do then if we just want Read-only access on GitHub API?

[abe-winter]

every CI provider has this problem as well -- using a CI provider on any repo requires giving them access to everything. specifically bad problem for people who are in multiple organizations or who have a mix of public + private repos

circleci has a docs page about it:

Note: CircleCI only asks for permissions that are absolutely necessary. However, CircleCI is constrained by the specific permissions each VCS provider chooses to supply. For example, getting a list of all user’s repos – public and private – from GitHub requires the repo scope, which is write-level access. GitHub does not provide a read-only permission for listing all a user’s repositories.

more granular scope would make it safer to use all kinds of codebase plugins

another approach would be to create a 'scoped subset' of my account that has access only to certain repos or organizations -- then the plugin vendor wouldn't have to worry about permissions

at the moment, is the best practice to create a whole new github account?

[VanTudor]

@github-staffthis discussion + a good amount of StackOverflow posts reference this issue all the way back to 2015-2016. Can you at least give a corporate-friendly answer to why more read-only scopes are not a thing yet?

Just repeating what everyone thinks about not having them:

• unnecessary security risks
• unnecessary liabilities for 3rd parties that use the API
• inhibits growth of 3rd parties that need only a subset the repos scope. Say I make an app that publishes statistics about the number of PRs opened by each user in an org. Every org that installs the app would be suspicious about giving it access to THEIR WHOLE CODEBASE.

[artiomchi]

I can't believe this has been completely ignored for YEARS...

[harmichimo]

Yeah, I saw a post dating back to 2015 about this. It makes no sense from a security standpoint.

[mpdude]

https://github.blog/2022-10-18-introducing-fine-grained-personal-access-tokens-for-github/ 👀

[mpdude]

Oh, what a fine sense of humor the GitHub team has! The above blog entry was published exactly 7 years (on October 18th) after the initial issue jollygoodcode/jollygoodcode.github.io#6 was raised.

[lookto]

This actually is not a good solution for oauth apps. It's not very userfriendy that the user has to create a token and select the right permissions in this huge mess of posibilities. I want to request access with my app with the correct scope preselected. Even after 7 years Microsoft did not understand the use cases that we have. Really disappointing.

[Firboio]

@github 🆘 🆘 🆘

Please let us know if you plan to fix this crucial issue for App Developers!

This limits the use of applications in Github significantly because clients don't want to install apps due to excessive scope! Please give us the ability to request read-only repos in OAuth App Scopes.

[booorisss]

@github

Please help

[infamous55]

It's crazy how GitHub OAuth still lacks a read-only scope for repos, despite an open issue since 2015. Hopefully, GitHub will prioritize this feature soon, as the fine-grained personal access tokens don't fit all the use cases.

[maastrich]

Damn, same problem here, I wasn't expecting this much messages but it reassure me about the fact that I'm in need of this feature (just a simple repo:read would be nice)

My company is ok for using a really helpful tool but the scopes necessary to read repositories are too high at the moment and it makes no sense

[frgfm]

Hey everyone,

So I encountered that problem a few minutes ago as well, but I managed to find a solution!

• PATs require too much efforts from non-power users, and unlike GH App, OAuth apps don't let you configure the access from GitHub directy
• however, your request for authentication to your OAuth app can include scopes: cf. API documentation

Note: Your OAuth app can request the scopes in the initial redirection. You can specify multiple scopes by separating them with a space using %20:

https://github.com/login/oauth/authorize? client_id=...& scope=user%20repo_deployment 

I just used that and it worked! The number of available scopes is limited but it's a start

Hope this helps ✌️

[infamous55]

Hey @frgfm! The problem we're discussing is that there is no read-only scope for a user's public and/or private repositories. The link you provided confirms this issue. Please refer to the original message in the discussion!

[frgfm]

My bad, I thought that on top of user-specific scope it was also about more general read-only aspects on other routes. And yes some are provided, some aren't indeed.

[brandymedia]

From what I have read this discussion has been going on for some time, so not going to hold my breath.

But as many others have mentioned, it would be prudent from a security perspective to be able to limit access to read only on private repos for example.

It seems a bit heavy handed to grant read/write/all access to apps that just want to read data.

Anyone found an explanation as to why this is not and will not be implemented?

[brandymedia]

There appears to be an option exactly like this for projects:

project - Grants read/write access to user and organization projects.
read:project - Grants read only access to user and organization projects.

Scopes for OAuth apps

[ms-ati]

Why can't an OAuth login request read-only access to a specific repo, as well? Why does it have to be all private repos?

[yu-iskw]

With the official GitHub MCP server now available, AI tools need secure, least-privilege access to both public and private repos. Today most clients fall back to long-lived PATs—cumbersome to rotate and prone to over-permission. By adopting OAuth 2.1 (PKCE, no implicit flow, fine-grained scopes) in MCP servers—and exposing a read-only scope for cloning/status checks—AI agents could obtain short-lived, read-only tokens via standard flows (see draft: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1). Managed providers like Composio’s MCP server already support OAuth out-of-the-box, handling token refresh and security best practices. Exposing a read-only OAuth scope will streamline credential management and enforce least-privilege for AI-driven workflows.
See discussion: modelcontextprotocol/modelcontextprotocol#205 (comment)

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams.
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences.
• GitHub staff may reach out for further clarification or insight.
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[AndreFavotto]

+1 for this feature request. Having read only access to OAuth apps would be really benefitial and honestly feels like a basic feature to expect.