Connect GitHub with a token

Connect GitHub or GitHub Enterprise with a fine-grained token that can only read, and its webhook.

In short

Connect GitHub with a token that can only read, when the GitHub App is not allowed. You make the token, try it on one repository, and add one webhook.

Before you start

• Who: someone who may manage the organization's connections - owners and admins have it by default.
• Plan: every plan keeps one code host; Business keeps 10 connections and Enterprise any number.
• First: a GitHub account that can read the repositories, and admin rights on them (or on the organization) to add a webhook.

Sign in

1. Open your organization, then Settings › "Connections", and press "Connect a code host".
2. Choose "GitHub with a token". The wizard opens; each step is checked before the next one opens.
3. Press "Open the token page". GitHub opens a new fine-grained token with read-only rights filled in.
4. In GitHub choose the Resource owner and the repositories under Repository access, keep Contents, Metadata and Pull requests on Read-only, and press Generate token.
5. Copy the token, paste it into "Token". A token that can write is refused.
6. Type one repository into "A repository to check with", as owner/name - such as acme/payments-api.
7. Press "Check this step". Every full check reads this repository, so pick one that stays.

Webhook

The webhook tells {{brand}} the moment something changes in GitHub, so nothing waits for the next read.

1. Press "Make the address and secret". Copy each with "Copy address" and "Copy secret" - the secret is shown only now.
2. In GitHub, open the organization (or one repository), then Settings, Webhooks, Add webhook.
3. Paste the address as the Payload URL and choose application/json as the Content type.
4. Paste the secret as the Secret.
5. Choose Let me select individual events, tick Pushes and Pull requests, and press Add webhook.
6. Back in the wizard, press "Look for a delivery". You can also go on with "Next"; deliveries show up under "Deliveries".

Check and use

1. Press "Run the full check". Every step should say Passed; a step that failed names what to change.
2. Under "Where will you use it?" tick the modules that will use it - Boards, Designer and API Tester.
3. Optional: under "Only these teams" tick the teams that may pick it. Leave it empty for everyone who may use those modules.
4. Check the "Name" - boards, designs and projects show it - and press "Finish". The connection shows under "Connections" with its health.

If a step fails

• A failed step names its code, what it means and what to change. The code's section of /help/settings/fix-a-company-connection says more.
• Change what the step says and press "Check again". The next step opens only when this one passes.
• Closing the wizard keeps every step that passed. Press "Continue setup" on the connection's row to go on where you stopped.

Good to know

• Fine-grained tokens end on the date you chose. Replace one from the connection's row with "Replace the credential" before it ends.
• One webhook on the GitHub organization covers every repository in it.

• A connection's row shows its health, its last delivery and "Where used".
• "Deliveries" lists what the webhook address received in the last 30 days and where each delivery went.
• "Disconnect" first lists every board, design and project that would stop using it.
• Nobody else pastes a token: boards, designs and API projects pick this connection.

Related

• /help/settings/connect-github-app
• /help/settings/fix-a-company-connection
• /help/settings/webhooks-and-site-ownership