CODEWITHSUNDEEP
githubgithub-api
muhqu
muhqu

Reputation: 12799

Verify that a GitHub OAuth token belongs to a specific ClientID

I'm looking for a way to verify that a GitHub OAuth token belongs to a specific client id.

It looks like, once you have an OAuth token, it can not be determined whether it is a…

  1. personal access token
  2. token issued using another app (other client_id)

Upvotes: 3

Views: 1043

Answers (1)

muhqu
muhqu

Reputation: 12799

There is an endpoint which allows an app owner to verify that a token actually belongs to their app:

GET /applications/:client_id/tokens/:access_token

[…] You must use Basic Authentication when accessing it, where the username is the OAuth application client_id and the password is its client_secret.[…]

This endpoint can be used to answer the first question "verify that a GitHub OAuth token belongs to a specific client id" only when you also know the client secret for a given client id.

There seems to be no way to answer the other question "[...] determined whether it is a personal access token [or] token issued using another app (other client id)"

See "check an authorization" in the GitHub OAuth Authorizations API documentation.

Upvotes: 3

Related Questions