| \n\nBrowsers\n\n | \n\nLoad `@octokit/auth-oauth-user` directly from [esm.sh](https://esm.sh)\n\n```html\n\n```\n\n |
|---|---|
| \n\nNode\n\n | \n\nInstall with `npm install @octokit/auth-oauth-user`\n\n```js\nimport { createOAuthUserAuth } from \"@octokit/auth-oauth-user\";\n```\n\n |
| \n\nBrowsers\n\n | \n\n`@octokit/auth-oauth-user` cannot be used in the browser. It requires `clientSecret` to be set which must not be exposed to clients, and some of the OAuth APIs it uses do not support CORS.\n\n |
|---|---|
| \n\nNode\n\n | \n\nInstall with `npm install @octokit/core @octokit/auth-oauth-user`. Optionally replace `@octokit/core` with a compatible module\n\n```js\nimport { Octokit } from \"@octokit/core\";\nimport { createOAuthUserAuth } from \"@octokit/auth-oauth-user\";\n```\n\n |
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n clientId\n | \n \n string\n | \n \n Required. Client ID of your GitHub/OAuth App. Find it on your app's settings page.\n | \n
\n clientSecret\n | \n \n string\n | \n \n Required. Client Secret for your GitHub/OAuth App. Create one on your app's settings page.\n | \n
\n clientType\n | \n \n string\n | \n \n Either \"oauth-app\" or \"github-app\". Defaults to \"oauth-app\".\n | \n
\n code\n | \n \n string\n | \n \n\n**Required.** The authorization code which was passed as query parameter to the callback URL from [GitHub's OAuth web application flow](https://docs.github.com/en/developers/apps/authorizing-oauth-apps#web-application-flow).\n\n | \n
\n state\n | \n \n string\n | \n \n\nThe unguessable random string you provided in [Step 1 of GitHub's OAuth web application flow](https://docs.github.com/en/developers/apps/authorizing-oauth-apps#1-request-a-users-github-identity).\n\n | \n
\n redirectUrl\n | \n \n string\n | \n \n\nThe redirect_uri parameter you provided in [Step 1 of GitHub's OAuth web application flow](https://docs.github.com/en/developers/apps/authorizing-oauth-apps#1-request-a-users-github-identity).\n\n | \n
\n request\n | \n \n function\n | \n \n You can pass in your own @octokit/request instance. For usage with enterprise, set baseUrl to the API root endpoint. Example:\n\n```js\nimport { request } from \"@octokit/request\";\ncreateOAuthAppAuth({\n clientId: \"1234567890abcdef1234\",\n clientSecret: \"1234567890abcdef1234567890abcdef12345678\",\n request: request.defaults({\n baseUrl: \"https://ghe.my-company.com/api/v3\",\n }),\n});\n```\n\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n clientId\n | \n \n string\n | \n \n Required. Client ID of your GitHub/OAuth App. Find it on your app's settings page.\n | \n
\n clientSecret\n | \n \n string\n | \n \n Required. Client Secret for your GitHub/OAuth App. The clientSecret is not needed for the OAuth device flow itself, but it is required for resetting, refreshing, and invalidating a token. Find the Client Secret on your app's settings page.\n | \n
\n clientType\n | \n \n string\n | \n \n Either \"oauth-app\" or \"github-app\". Defaults to \"oauth-app\".\n | \n
\n onVerification\n | \n \n function\n | \n \n\n**Required**. A function that is called once the device and user codes were retrieved\n\nThe `onVerification()` callback can be used to pause until the user completes step 2, which might result in a better user experience.\n\n```js\nconst auth = createOAuthUserAuth({\n clientId: \"1234567890abcdef1234\",\n clientSecret: \"1234567890abcdef1234567890abcdef12345678\",\n onVerification(verification) {\n console.log(\"Open %s\", verification.verification_uri);\n console.log(\"Enter code: %s\", verification.user_code);\n\n await prompt(\"press enter when you are ready to continue\");\n },\n});\n```\n\n | \n
\n request\n | \n \n function\n | \n \n You can pass in your own @octokit/request instance. For usage with enterprise, set baseUrl to the API root endpoint. Example:\n\n```js\nimport { request } from \"@octokit/request\";\ncreateOAuthAppAuth({\n clientId: \"1234567890abcdef1234\",\n clientSecret: \"1234567890abcdef1234567890abcdef12345678\",\n onVerification(verification) {\n console.log(\"Open %s\", verification.verification_uri);\n console.log(\"Enter code: %s\", verification.user_code);\n\n await prompt(\"press enter when you are ready to continue\");\n },\n request: request.defaults({\n baseUrl: \"https://ghe.my-company.com/api/v3\",\n }),\n});\n```\n\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n clientType\n | \n \n string\n | \n \n Required. Either \"oauth-app\" or \"github\".\n | \n
\n clientId\n | \n \n string\n | \n \n Required. Client ID of your GitHub/OAuth App. Find it on your app's settings page.\n | \n
\n clientSecret\n | \n \n string\n | \n \n Required. Client Secret for your GitHub/OAuth App. Create one on your app's settings page.\n | \n
\n token\n | \n \n string\n | \n \n Required. The user access token\n | \n
\n scopes\n | \n \n array of strings\n | \n \n Required if clientType is set to \"oauth-app\". Array of OAuth scope names the token was granted\n | \n
\n refreshToken\n | \n \n string\n | \n \n Only relevant if clientType is set to \"github-app\" and token expiration is enabled.\n | \n
\n expiresAt\n | \n \n string\n | \n \n Only relevant if clientType is set to \"github-app\" and token expiration is enabled. Date timestamp in ISO 8601 standard. Example: 2022-01-01T08:00:0.000Z\n | \n
\n refreshTokenExpiresAt\n | \n \n string\n | \n \n Only relevant if clientType is set to \"github-app\" and token expiration is enabled. Date timestamp in ISO 8601 standard. Example: 2021-07-01T00:00:0.000Z\n | \n
\n request\n | \n \n function\n | \n \n You can pass in your own @octokit/request instance. For usage with enterprise, set baseUrl to the API root endpoint. Example:\n\n```js\nimport { request } from \"@octokit/request\";\ncreateOAuthAppAuth({\n clientId: \"1234567890abcdef1234\",\n clientSecret: \"1234567890abcdef1234567890abcdef12345678\",\n request: request.defaults({\n baseUrl: \"https://ghe.my-company.com/api/v3\",\n }),\n});\n```\n\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n type\n | \n \n string\n | \n \n\nWithout setting `type` auth will return the current authentication object, or exchange the `code` from the strategy options on first call. If the current authentication token is expired, the tokens will be refreshed.\n\nPossible values for `type` are\n\n- `\"get\"`: returns the token from internal state and creates it if none was created yet\n- `\"check\"`: sends request to verify the validity of the current token\n- `\"reset\"`: invalidates current token and replaces it with a new one\n- `\"refresh\"`: GitHub Apps only, and only if expiring user tokens are enabled.\n- `\"delete\"`: invalidates current token\n- `\"deleteAuthorization\"`: revokes OAuth access for application. All tokens for the current user created by the same app are invalidated. The user will be prompted to grant access again during the next OAuth web flow.\n\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n type\n | \n \n string\n | \n \n \"token\"\n | \n
\n tokenType\n | \n \n string\n | \n \n \"oauth\"\n | \n
\n clientType\n | \n \n string\n | \n \n \"oauth-app\"\n | \n
\n clientId\n | \n \n string\n | \n \n The clientId from the strategy options\n | \n
\n clientSecret\n | \n \n string\n | \n \n The clientSecret from the strategy options\n | \n
\n token\n | \n \n string\n | \n \n The user access token\n | \n
\n scopes\n | \n \n array of strings\n | \n \n array of scope names enabled for the token\n | \n
\n onTokenCreated\n | \n \n function\n | \n \n callback invoked when a token is \"reset\" or \"refreshed\"\n | \n
\n invalid\n | \n \n boolean\n | \n \n\nEither `undefined` or `true`. Will be set to `true` if the token was invalided explicitly or found to be invalid\n\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n type\n | \n \n string\n | \n \n \"token\"\n | \n
\n tokenType\n | \n \n string\n | \n \n \"oauth\"\n | \n
\n clientType\n | \n \n string\n | \n \n \"github-app\"\n | \n
\n clientId\n | \n \n string\n | \n \n The clientId from the strategy options\n | \n
\n clientSecret\n | \n \n string\n | \n \n The clientSecret from the strategy options\n | \n
\n token\n | \n \n string\n | \n \n The user access token\n | \n
\n onTokenCreated\n | \n \n function\n | \n \n callback invoked when a token is \"reset\" or \"refreshed\"\n | \n
\n invalid\n | \n \n boolean\n | \n \n\nEither `undefined` or `true`. Will be set to `true` if the token was invalided explicitly or found to be invalid\n\n | \n
| \n name\n | \n\n type\n | \n\n description\n | \n
|---|---|---|
\n type\n | \n \n string\n | \n \n \"token\"\n | \n
\n tokenType\n | \n \n string\n | \n \n \"oauth\"\n | \n
\n clientType\n | \n \n string\n | \n \n \"github-app\"\n | \n
\n clientId\n | \n \n string\n | \n \n The clientId from the strategy options\n | \n
\n clientSecret\n | \n \n string\n | \n \n The clientSecret from the strategy options\n | \n
\n token\n | \n \n string\n | \n \n The user access token\n | \n
\n refreshToken\n | \n \n string\n | \n \n The refresh token\n | \n
\n expiresAt\n | \n \n string\n | \n \n Date timestamp in ISO 8601 standard. Example: 2022-01-01T08:00:0.000Z\n | \n
\n refreshTokenExpiresAt\n | \n \n string\n | \n \n Date timestamp in ISO 8601 standard. Example: 2021-07-01T00:00:0.000Z\n | \n
\n invalid\n | \n \n boolean\n | \n \n\nEither `undefined` or `true`. Will be set to `true` if the token was invalided explicitly or found to be invalid\n\n | \n