For most integrations, choose a GitHub App. It requests targeted permissions, is installed on chosen repositories, and uses installation tokens that expire after one hour. An OAuth app fits when you must act strictly as a signed-in user and accept broader scopes and longer-lived tokens.
The differences that matter for risk
GitHub's documentation compares the two. The security-relevant points are below.
| Property | GitHub App | OAuth app |
|---|---|---|
| Permissions | Targeted permissions, only what the app needs | Broad scopes such as repo |
| Repository access | Chosen repositories on install | Whatever the authorizing user can reach |
| Token life | Installation tokens expire, currently after 1 hour | Long-lived by default, optional expiry after eight hours with refresh |
| Who installs | Org owner, or admin on a repository | If an org policy is active, only an owner can authorize |
The last row matters for governance. Where an organization application policy is turned on, an owner decides which OAuth apps are authorized. That is a good gate to have.
Why this changes your blast radius
Suppose an integration's token is stolen. With an OAuth app, the thief gets the user's reach under a broad scope, possibly across every repository that user can see, for a long time. With a GitHub App, the thief gets one hour and the repositories the app was installed on, limited to the permissions it asked for.
The same logic applies to a departing employee. An OAuth grant tied to a person ends up in limbo when they leave. An app installation belongs to the organization.
Decision guide
- Does the integration act on its own, such as commenting on pull requests or syncing issues? Use a GitHub App.
- Does it need to act strictly as the signed-in person, such as showing that person's private data? An OAuth app, or a GitHub App with user authorization, may fit.
- Can you list the exact permissions needed? If yes, a GitHub App lets you ask for only those. If you cannot, find out before building.
- Who will own it in a year? Make the organization the owner, not an individual account.
For people installing a third-party integration
- Prefer integrations that offer an app installation over a personal token.
- Limit the install to the repositories it needs, not all repositories.
- Read the permission list. If a code review bot asks to write to repository administration, ask why.
- Record the install in your integration inventory with an owner and a review date.
Quick check
Are installation tokens the same as personal access tokens?
No. Installation tokens belong to an app, are scoped to the installation and expire after about an hour. Personal tokens belong to a person.
Can I limit an OAuth app to one repository?
OAuth apps use broad scopes, and the grant follows what the user can access. A GitHub App is the better tool for repository level limits.
Safeguard's policies and gates can check pull requests that integrations raise, including fix PRs from autonomous remediation, which is off by default. Run the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
