Scenario

You’re building a web-based internal tool that integrates with GitHub. You want the app to allow users to log in and fetch GitHub repositories without storing their credentials — using OAuth 2.0.

OAuth Roles

• Resource Owner: User who owns GitHub account.
• Client: Internal web app.
• Authorization Server: GitHub OAuth.
• Resource Server: GitHub APIs.

Step-by-Step OAuth Flow

Step 1: Register App in GitHub (Authorization Server)

• Go to GitHub > Settings > Developer Settings > OAuth Apps > New OAuth App
• App name: Internal-GitHub-Tool
• Homepage: https://internalapp.example.com
• Callback URL: https://internalapp.example.com/oauth/callback

Step 2: Get Client ID and Secret

• GitHub gives you:
• Client ID
• Client Secret

Step 3: Implement Authorization Code Flow in Your App

Step 3.1: Redirect to GitHub Authorization URL:

https://github.com/login/oauth/authorize?

client_id=XXXX&redirect_uri=https://internalapp.example.com/oauth/callback&scope=repo,user

Step 3.2: User logs in → GitHub sends code to redirect URI:

https://internalapp.example.com/oauth/callback?code=AUTH_CODE

Step 3.3: Your App Exchanges Code for Access Token

POST to:

https://github.com/login/oauth/access_token

Body:

{

  “client_id”: “XXXX”,

  “client_secret”: “YYYY”,

  “code”: “AUTH_CODE”

}

Step 3.4: GitHub Returns Access Token

{

  “access_token”: “abcdef123456…”,

  “token_type”: “bearer”,

  “scope”: “repo,user”

}

Step 3.5: Use Access Token to Call GitHub API

GET https://api.github.com/user

Authorization: Bearer abcdef123456…