Define authorization areas for a given Github token

Question

My application uses Github Oauth . Let's pretend that:

• in version 1, the application requires only basic authorization (scopes = [])
• in version 2, the application requires R / W access to public repositories (scope = ['public_repo'])

Some users have not logged in since the update.

Now I have some tokens with great authorization capabilities, and then others. How can I tell each other? In other words, how can I ask Github: "Hey, I have this oauth token ... what can I do with it?"

Answer 1

You can make any GitHub API request and read the value of the X-OAuth-Scopes header to see which areas have been tokenized. Using / rate _limit will not be considered when limiting the speed of your application.

curl -I -H 'Authorization: token <token>' https://api.github.com/rate_limit HTTP/1.1 200 OK Server: nginx Date: Thu, 18 Oct 2012 23:48:37 GMT Content-Type: application/json; charset=utf-8 Connection: keep-alive Status: 200 OK Content-Length: 61 X-GitHub-Media-Type: github.beta X-RateLimit-Remaining: 4999 X-RateLimit-Limit: 5000 X-OAuth-Scopes: public_repo Cache-Control: X-Content-Type-Options: nosniff 

Answer 2

(February 2014): Advanced OAuth Protection for SSH Keys

We just added more detailed permissions , so third-party applications may request read-only access, read / write access or full administrator access to your public SSH keys.

---

Note that access-token now (October 2013) also returns scope.

This is described in detail in the OAuth Change Section (October 2013, Tim Cleam - tclem ):

Starting today, we are returning the provided scopes as part of the access_token response.
For example, if you create a POST with type application/json mime, you will see an additional field for the provided areas.

 { "access_token":"e72e16c7e42f292c6912e7710c838347ae178b4a", "scope":"repo,gist", "token_type":"bearer" } 

Currently, these areas will be identical to requests, but we are moving towards a set of functions that will allow GitHub users to edit their areas of activity, effectively giving your application less access than you originally requested .
You should be aware of this feature and adjust app behavior accordingly.

Some things to keep in mind and keep in mind:

• Most third-party applications that use GitHub OAuth to authenticate users have the best success at accepting, starting with the minimum access request that the application can leave with. Something like realms or just user:email very reasonable.

• It’s important to handle error cases where users decide to give you less access than you originally requested.
  Now, when we look at the provided areas in the access_token response, applications can warn or otherwise inform their users that they will see reduced functionality or will not be able to perform some actions.

• Applications can always send users back through the stream to get additional permissions, but don't forget that users can always say no.