> For the complete documentation index, see [llms.txt](https://codemash.gitbook.io/codemash/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://codemash.gitbook.io/codemash/cloud/membership/integrations/providers/github.md).

# GitHub

Connect GitHub to Membership — let your users sign in with GitHub.

Lets your users sign in with their GitHub account, through a GitHub OAuth App.

## Get your credentials

1. On GitHub, click your profile picture → **Settings** → **Developer settings** → **OAuth apps**.
2. Press **New OAuth App** (or **Register a new application**). Fill **Application name**, **Homepage URL** and **Authorization callback URL**, then **Register application**.
3. Copy the **Client ID** from the app page. Press **Generate a new client secret** and copy the secret.

Source: GitHub, [Creating an OAuth app](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app).

## Connect it in Cloud

**Where:** Membership → Integrations → **Add New Integration** → GitHub → **Connect** · `/projects/<project>/membership/integrations/new/github`

Fill the form and press **Save**. The form stays open as **Editing GitHub integration** with the **ENABLED** badge and the new id (`int_4EZ3ooFfOKjEVBKIVjYzTJ`).

| Field            | Required  | What it does                                                         | Example                          |
| ---------------- | --------- | -------------------------------------------------------------------- | -------------------------------- |
| Client Id        | yes (new) | The OAuth App client id.                                             | `Iv1.example00000000`            |
| Client Secret    | yes       | The matching client secret. Encrypted on save and never shown again. | `example-not-a-secret` (made up) |
| Integration Name | yes       | The name in your integrations list.                                  | `GitHub sign-in`                 |

**OAuth Modes** — press **Add OAuth mode** for each surface of your app (web, mobile, admin) that signs in with this provider:

| Field                                      | Required | What it does                                       | Example                                        |
| ------------------------------------------ | -------- | -------------------------------------------------- | ---------------------------------------------- |
| Mode name                                  | yes      | A name for the surface.                            | `web`                                          |
| Callback URL                               | yes      | Where the user lands in your app after signing in. | `https://app.example.com/auth/github/callback` |
| Logout URL (optional)                      | no       | Where the user lands after signing out.            | —                                              |
| Failure redirect URL (optional)            | no       | Where the user lands when the sign-in fails.       | `https://app.example.com/sign-in?failed=1`     |
| Role to assign on first sign-in (optional) | no       | The role a new user gets on the first sign-in.     | —                                              |

<figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-fd4aa01c47726eb31ffb9d0592fd5e22928f5280%2Fgithub-form-1.png?alt=media" alt="New GitHub Integration form: Client Id Iv1.example00000000, a hidden Client Secret, Integration Name GitHub sign-in"><figcaption><p>The filled form.</p></figcaption></figure>

<figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-57766d85e9e286087ac4f45c3723deee18898123%2Fgithub-form-2.png?alt=media" alt="OAuth Modes with one mode: Mode name web, Callback URL https://app.example.com/auth/github/callback, Failure redirect URL https://app.example.com/sign-in?failed=1, and Add OAuth mode"><figcaption><p>One OAuth mode for the web app.</p></figcaption></figure>

<figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-1be5bae16b7aff8e9e164e624445d5a811c88e99%2Fgithub-saved-3.png?alt=media" alt="Editing GitHub integration after save: the ENABLED badge, the id int_4EZ3ooFfOKjEVBKIVjYzTJ, the provider fields empty and the Integration Name GitHub sign-in"><figcaption><p>After save.</p></figcaption></figure>

{% hint style="warning" %}
Two things to know today. **(1)** When you open a saved integration, its fields come back empty — only the name and the state load, and the saved OAuth modes are not shown — so type every value again before you press **Save** on it. **(2)** No Norbix sign-in endpoint uses membership integrations yet: saving stores the settings, but your users cannot sign in with GitHub through the API until it ships.
{% endhint %}

## Test and set as default

Membership integrations have no **Test** and no **Set as default** in Cloud — see [Test an integration](/codemash/cloud/membership/integrations/test.md) and [Set an integration as default](/codemash/cloud/membership/integrations/set-default.md). Check the values against the provider's console; **Actions → Disable** turns the integration off — see [Disable or delete an integration](/codemash/cloud/membership/integrations/disable.md).

## Common errors

| Message                                                                | Cause                                                             | Fix                                                     |
| ---------------------------------------------------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------- |
| *Required* under a field                                               | A required field is empty.                                        | Fill it; on a saved integration, type the secret again. |
| Secret is not provided (`CM-ERRORS-SECRETS-001`)                       | Saved from code without the secret.                               | Send the secret on every save.                          |
| *The redirect\_uri MUST match the registered callback URL* (at GitHub) | The address your app sends is not the Authorization callback URL. | Change the OAuth App, or the address your app sends.    |

Messages marked *(at …)* are the provider's own, shown to the user while signing in; see the [provider documentation](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app).

## Do it from code

```sh
norbix hub membership integration save --integration '{"provider":"GitHub","integrationName":"GitHub (staging)","isEnabled":true,"clientId":"Iv1.staging0000000","clientSecret":"your-github-client-secret"}'
```

With the SDK, send the same object as `integration` to `saveMembershipIntegration` — see the run example on [Providers](/codemash/cloud/membership/integrations/providers.md#do-it-from-code) and in [Save Membership Integration](/codemash/sdks/membership/integrations/save-membership-integration.md). Send `isEnabled: true`; to update, add the id as `integrationId` and the secret again. API: [Save Membership Integration](/codemash/api-reference/membership/integrations/save-membership-integration.md)