Skip to main content

GitHub authentication

Not yet available (2.4.x)

The GitHub provider is not enabled yet. Only Google is live right now — calling auth.signIn() with this provider throws AuthErrorCode.PROVIDER_NOT_ENABLED. The page below documents its intended shape for when it is re-enabled. See the provider overview and the Google provider.

The GitHub provider signs users in with GitHub's OAuth authorization-code flow. The browser obtains an authorization code, but the code-to-token exchange must happen on a server.

When you need a backend​

A backend is required. GitHub does not permit browser-side code-to-token exchange — it needs the client secret and blocks CORS on its token endpoint. You must set tokenExchangeProxy (alias tokenEndpoint) to a server endpoint. Without it, sign-in throws a MISSING_CONFIG error explaining that a proxy is required.

The proxy receives { code, redirectUri, state } as a JSON POST body and must return GitHub's token JSON (for example { access_token, token_type, scope }). Keep the client secret on the server.

Configuration​

import { auth } from 'capacitor-auth-manager';

auth.configure({
  providers: {
    github: {
      clientId: 'YOUR_GITHUB_CLIENT_ID',
      redirectUri: 'https://your-app.com/auth/github/callback',
      tokenExchangeProxy: 'https://your-api.com/auth/github/token',
      scopes: ['read:user', 'user:email'],
    },
  },
});

Options​

From the GitHubAuthOptions interface in src/definitions.ts:

OptionTypeRequiredPurpose
clientIdstringYesGitHub OAuth app client ID.
redirectUristringYesRedirect URI registered with the OAuth app.
tokenExchangeProxystringYes in practiceBackend endpoint that exchanges the code for a token. Without it, sign-in fails.
tokenEndpointstringNoAlias for tokenExchangeProxy.
clientSecretstringNoKeep on the server (the proxy uses it) — never embed in the browser.
scopesstring[]NoOAuth scopes to request.
allowSignupbooleanNoAllow users without an account to sign up during authorization.
loginstringNoSuggest a specific account to sign in with.
statestringNoCSRF state value (also forwarded to the proxy).

Sign in​

await auth.signIn('github');

Notes & caveats​

  • tokenExchangeProxy (or tokenEndpoint) is mandatory; the in-browser flow cannot complete without it.
  • The provider generates and tracks a CSRF state value and forwards it to the proxy for re-verification.
  • The library does not verify tokens in the browser — validate the GitHub access token server-side.