Python Github Oauth Authentication Flow

2. Build the Authorization URL

The first user‑facing step is to redirect the user to GitHub’s authorization endpoint. The URL must include:

https://github.com/login/oauth/authorize?
client_id=YOUR_CLIENT_ID
&redirect_uri=YOUR_CALLBACK_URL
&scope=repo,user
&state=RANDOM_STRING

Key parameters:

• client_id – your app’s public identifier.
• redirect_uri – must match the URL registered with GitHub.
• scope – a space‑separated list of permissions (e.g., repo for private repo access, user for profile data).
• state – a cryptographically random string to prevent CSRF attacks; store it in the user’s session and verify it on callback.

3. Handle the Callback and Exchange Code for a Token

When the user authorizes, GitHub redirects to your /callback endpoint with code and state query parameters. Verify the state value, then POST the following to https://github.com/login/oauth/access_token:

POST https://github.com/login/oauth/access_token
Headers:
  Accept: application/json
Body (application/x-www-form-urlencoded):
  client_id=YOUR_CLIENT_ID
  client_secret=YOUR_CLIENT_SECRET
  code=AUTHORIZATION_CODE
  redirect_uri=YOUR_CALLBACK_URL
  state=STATE_VALUE

The response contains a JSON object with access_token, token_type (always “bearer”), and the granted scope. Store the token securely—preferably in a server‑side session or a signed JWT.

4. Use the Access Token to Call the GitHub API

All subsequent GitHub API requests include the token in the Authorization header:

GET https://api.github.com/user
Headers:
  Authorization: Bearer YOUR_ACCESS_TOKEN
  Accept: application/vnd.github.v3+json

Typical use cases include fetching the authenticated user’s profile, listing repositories, or creating issues. Remember to respect rate limits (5000 requests per hour per token) and handle 403 responses gracefully.

5. Refresh Tokens and Revoking Access (GitHub specifics)

GitHub does not issue refresh tokens; access tokens are long‑lived until the user revokes them. To programmatically revoke a token, send a DELETE request to https://api.github.com/applications/:client_id/token with basic auth using the Client ID and Client Secret. This is useful for “Logout” functionality.

Sample Code with Flask

import os

import secrets

from urllib.parse import urlencode

import requests

from flask import Flask, redirect, request, session, url_for, render_template_string

from dotenv import load_dotenv
load_dotenv()  # Loads CLIENT_ID, CLIENT_SECRET from .env
app = Flask(__name__)

app.secret_key = os.urandom(24)  # Needed for session handling
GITHUB_AUTH_URL = "https://github.com/login/oauth/authorize"

GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token"

GITHUB_API_URL = "https://api.github.com"
@app.route("/")

def index():

    user = session.get("github_user")

    if user:

        return render_template_string(

            "
Logged in as {{login}}
"

            "
Logout
", login=user["login"]

        )

    return render_template_string(

        "
Welcome! Login with GitHub
"

    )
@app.route("/login")

def login():

    state = secrets.token_urlsafe(16)

    session["oauth_state"] = state

    params = {

        "client_id": os.getenv("CLIENT_ID"),

        "redirect_uri": url_for("callback", _external=True),

        "scope": "repo user",

        "state": state,

    }

    return redirect(f"{GITHUB_AUTH_URL}?{urlencode(params)}")
@app.route("/callback")

def callback():

    # Verify state to mitigate CSRF

    if request.args.get("state") != session.get("oauth_state"):

        return "State mismatch", 400
    code = request.args.get("code")

    token_resp = requests.post(

        GITHUB_TOKEN_URL,

        headers={"Accept": "application/json"},

        data={

            "client_id": os.getenv("CLIENT_ID"),

            "client_secret": os.getenv("CLIENT_SECRET"),

            "code": code,

            "redirect_uri": url_for("callback", _external=True),

            "state": session["oauth_state"],

        },

    )

    token_resp.raise_for_status()

    access_token = token_resp.json()["access_token"]
    # Fetch user profile

    user_resp = requests.get(

        f"{GITHUB_API_URL}/user",

        headers={"Authorization": f"Bearer {access_token}", "Accept": "application/vnd.github.v3+json"},

    )

    user_resp