- GitHub App (Recommended)
- OAuth
- Personal Access Token
Infisical will use a GitHub App with finely grained permissions to connect to GitHub.
Self-Hosted Instance
Self-Hosted Instance
Using the GitHub integration with app authentication on a self-hosted instance of Infisical requires configuring an application on GitHub
and registering your instance with it.
Create an application on GitHub
Navigate to the GitHub app settings here. Click New GitHub App.
Give the application a name, a homepage URL (your self-hosted domain i.e. 
Enable request user authorization during app installation.
Disable webhook by unchecking the Active checkbox.
Set the repository permissions as follows: Metadata: Read-only, Secrets: Read and write, Environments: Read and write, Actions: Read.
Similarly, set the organization permissions as follows: Secrets: Read and write.
Create the Github application.
Give the application a name, a homepage URL (your self-hosted domain i.e. https://your-domain.com), and a callback URL (i.e. https://your-domain.com/organization/app-connections/github/oauth/callback).Enable request user authorization during app installation.Disable webhook by unchecking the Active checkbox.Set the repository permissions as follows: Metadata: Read-only, Secrets: Read and write, Environments: Read and write, Actions: Read.Similarly, set the organization permissions as follows: Secrets: Read and write.Create the Github application.If you have a GitHub organization, you can create an application under it
in your organization Settings > Developer settings > GitHub Apps > New GitHub App.
Add your application credentials to Infisical
Generate a new Client Secret for your GitHub application.
Generate a new Private Key for your Github application.
Obtain the necessary Github application credentials. This would be the application slug, client ID, app ID, client secret, and private key.
Back in your Infisical instance, you can configure the GitHub App credentials in one of two ways:Option 1: Server Admin Panel (Recommended)Navigate to the server admin panel > Integrations > GitHub App and enter the GitHub application credentials:
Once configured, you can use the GitHub integration via app authentication. If you configured the credentials using environment variables, restart your Infisical instance for the changes to take effect. If you configured them through the server admin panel, allow approximately 5 minutes for the changes to propagate.
Generate a new Private Key for your Github application.Obtain the necessary Github application credentials. This would be the application slug, client ID, app ID, client secret, and private key.Back in your Infisical instance, you can configure the GitHub App credentials in one of two ways:Option 1: Server Admin Panel (Recommended)Navigate to the server admin panel > Integrations > GitHub App and enter the GitHub application credentials:- Client ID: The Client ID of your GitHub application
- Client Secret: The Client Secret of your GitHub application
- App Slug: The Slug of your GitHub application (found in the URL)
- App ID: The App ID of your GitHub application
- Private Key: The Private Key of your GitHub application
INF_APP_CONNECTION_GITHUB_APP_CLIENT_ID: The Client ID of your GitHub application.INF_APP_CONNECTION_GITHUB_APP_CLIENT_SECRET: The Client Secret of your GitHub application.INF_APP_CONNECTION_GITHUB_APP_SLUG: The Slug of your GitHub application. This is the one found in the URL.INF_APP_CONNECTION_GITHUB_APP_ID: The App ID of your GitHub application.INF_APP_CONNECTION_GITHUB_APP_PRIVATE_KEY: The Private Key of your GitHub application.INF_APP_CONNECTION_GITHUB_APP_HOST(GitHub Enterprise Server only): The hostname of the GitHub instance where the shared GitHub App is registered (e.g.github.mycompany.com). Only required when the shared app is registered on a GHES instance. Defaults togithub.com.
If your shared GitHub App is registered on a GitHub Enterprise Server instance, you must set
INF_APP_CONNECTION_GITHUB_APP_HOST to that instance’s hostname. Without it, the OAuth exchange will be directed to github.com instead of your GHES host.Setup GitHub Connection in Infisical
Navigate to App Connections
Navigate to the Integrations tab in the desired project, then select App Connections.
Authorize Connection
Select the GitHub App method.Choose which GitHub App to use for the connection:
When managing your apps, you can inspect them on GitHub, delete existing apps, or click Create New GitHub App to register a new app directly from Infisical using GitHub’s App Manifest flow. New apps are automatically configured with the required permissions and callback URLs.
You may optionally enable GitHub Enterprise to configure enterprise-specific options:
- Instance — the instance-default GitHub App configured by your Infisical server admin.
- Private — a GitHub App registered under your organization. Select an existing one from the list, or click the gear to manage your private apps.
GitHub Apps are scoped to where they were created: apps created from the organization’s App Connections page are available to organization-level connections and to every project, while apps created from a project’s App Connections page are only available within that project. The shared instance-default app is available in both scopes.
When managing your apps, you can inspect them on GitHub, delete existing apps, or click Create New GitHub App to register a new app directly from Infisical using GitHub’s App Manifest flow. New apps are automatically configured with the required permissions and callback URLs.You may optionally enable GitHub Enterprise to configure enterprise-specific options:- Instance Type: Enterprise Cloud or Enterprise Server
- Instance Hostname: The hostname of your GitHub Enterprise instance (e.g.
github.mycompany.com) - Gateway: The gateway connected to your private network (Enterprise Server only)
Install GitHub App
You will then be redirected to the GitHub app installation page.Install and authorize the GitHub application. This will redirect you back to Infisical’s App Connections page.
