No results
Search failed
No results
Narrow your search with type:list, type:token, #tag…↑↓ to move · Enter to open · Esc to close

Set up "Sign in with GitHub"

This is the full version of the wizard in the dashboard. It takes about five minutes, and costs nothing. You'll copy a client ID and a client secret from GitHub into JSONPad, and one URL from JSONPad into GitHub.

If you haven't read it yet, signing in with Google, GitHub and others explains how the whole flow works.

1. Create an OAuth app

  1. Go to Settings → Developer settings → OAuth Apps and click New OAuth app. To let an organization own it instead, use the organization's Settings → Developer settings.
  2. Application name and Homepage URL are shown to people when they sign in, so use your app's real name and address.
  3. Authorization callback URL: the URL from the next step.
  4. Leave Enable Device Flow unticked, and click Register application.
  5. Copy the Client ID, then click Generate a new client secret and copy that too. GitHub only shows a secret once.

An OAuth app is enough for signing in. GitHub Apps are a different thing, for acting on repositories, and aren't supported here.

2. Which callback URL to use

A GitHub OAuth app has one authorization callback URL, so through JSONPad is the default for GitHub:

https://api.jsonpad.io/identities/oauth/callback

JSONPad passes each sign-in on to whichever of your identity group's redirect URLs started it, so one GitHub app covers production, staging and localhost, and you never come back here to add an environment.

You can use straight back to your app mode instead, but GitHub then only accepts return pages on the same host as the callback URL, at that path or below it, so you'd need a separate OAuth app for each environment.

3. Paste the credentials into JSONPad

  1. Open your identity group in the dashboard, find GitHub under Sign-in providers, and click Set up.
  2. Add the pages in your app that sign-ins return to, as the group's redirect URLs.
  3. Paste the client ID and secret, then click Save and check. JSONPad asks GitHub whether the pair is valid and tells you straight away. The secret is encrypted, and can't be read back afterwards.
  4. Run a test sign-in with your own GitHub account. It shows what GitHub sent back, and creates nothing.
  5. Turn GitHub on for the group with Enable.

4. Email addresses

JSONPad asks for the read:user and user:email scopes, and uses the account's primary email address, but only when GitHub says it's verified. People who keep their address private still get an identity, just without an email address, so don't rely on having one.

5. Going live

There's nothing to publish or have reviewed: anyone with a GitHub account can sign in as soon as the OAuth app exists. Two things are worth doing:

  • Add a logo to the OAuth app in GitHub. It appears on the authorization screen.
  • Use separate OAuth apps (and identity groups) for development and production, so a development secret can't be used against your live app.

Troubleshooting

  • The redirect_uri MUST match the registered callback URL for this applicationThe callback URL in GitHub doesn't match the one JSONPad used. In "through JSONPad" mode it must be exactly https://api.jsonpad.io/identities/oauth/callback.
  • incorrect_client_credentialsGitHub rejected the client ID and secret together. Generate a new secret and save it in JSONPad; make sure both come from the same OAuth app.
  • Not FoundGitHub doesn't know this client ID at all. Check it was copied from Client ID (not the app's name or its ID in the URL), and that the app hasn't been deleted.
  • bad_verification_codeThe sign-in code expired or was already used. Codes last about ten minutes; start signing in again.
  • access_deniedThe person clicked Cancel on GitHub's authorization screen.
  • No email addressTheir primary address is unverified or hidden. Ask for one in your app and set it on the identity.
2026-09-17