AI Security

Securely Granting a Coding Agent Private GitHub Access with GitHub Apps

Published 2026-09-15 by AISecAll Editorial

TL;DR: Create a GitHub App with only the repository scopes you need, generate a short‑lived installation token, inject that token into your OpenAI (or Claude) coding agent, rotate the token regularly, and log every API call to GitHub’s audit log. This gives the agent the access it needs while keeping the rest of your codebase and secrets safe.

What is a coding agent and why limit its GitHub access?

A coding agent is an LLM‑driven tool that can read, edit, and commit code on your behalf. Because it can execute commands that modify source, unrestricted GitHub access is a high‑impact risk. Limiting the agent to the smallest set of permissions reduces the blast radius of a prompt‑injection attack or a misbehaving model.

Step 1 – Create a GitHub App with least‑privilege scopes

• Navigate to GitHub Settings → Developer settings → GitHub Apps.
• Click New GitHub App and give it a clear name, e.g., ai‑coding‑agent.
• Under Permissions, enable only the scopes required for your workflow:
  • Contents – Read & write (if the agent must commit changes).
  • Pull requests – Read & write (if the agent opens PRs).
  • Leave all other permissions at None.
• Set Repository access to Only selected repositories and pick the private repo(s) the agent should touch.
• Save the app; GitHub will generate a private key for JWT signing.

Step 2 – Configure the App for token‑based authentication

GitHub Apps use a two‑step flow: a signed JWT authenticates the app, then an installation access token is issued for the selected repositories. The token is short‑lived (default 1 hour) and can be refreshed programmatically.

import jwt, time, requests
# 1️⃣ Create JWT (expires in 10 min)
payload = {
    "iat": int(time.time()),
    "exp": int(time.time()) + 600,
    "iss": APP_ID
}
jwt_token = jwt.encode(payload, PRIVATE_KEY, algorithm="RS256")
# 2️⃣ Exchange JWT for installation token
resp = requests.post(
    f"https://api.github.com/app/installations/INSTALLATION_ID/access_tokens",
    headers={"Authorization": f"Bearer {jwt_token}"}
)
access_token = resp.json()["token"]

Store access_token in a secure runtime secret (e.g., Cloudflare Workers KV with encryption) and pass it to the AI agent as an environment variable.

Step 3 – Integrate the token with your OpenAI (or Claude) coding agent

Most managed‑agent platforms let you define tool calls that invoke external APIs. Add a github tool that includes the token in the Authorization header:

{
  "name": "github",
  "description": "Interact with the private repo",
  "parameters": {
    "type": "object",
    "properties": {
      "method": {"type": "string"},
      "path": {"type": "string"},
      "body": {"type": "string"}
    },
    "required": ["method", "path"]
  }
}

When the agent calls this tool, your backend injects the Authorization: token <access_token> header and forwards the request to GitHub’s REST API. Because the token is scoped to the selected repo, the agent cannot wander into other codebases.

Step 4 – Rotate and revoke tokens safely

• Automate token renewal every hour (or shorter) using a scheduled job (e.g., Cloudflare Workers Cron Trigger).
• Store the previous token for a brief overlap window (max 5 minutes) to avoid race conditions.
• If you suspect misuse, revoke the installation token via the API or delete the app’s installation from the repository settings.

Step 5 – Monitor and audit usage

GitHub records every token‑based request in its audit log. Pull that log into your observability stack (e.g., Loki or Datadog) and watch for:

• Unexpected DELETE or FORCE_PUSH actions.
• Requests originating from IPs outside your trusted edge (Cloudflare Workers IP ranges).
• Spike in commit volume within a short window.

Combine the audit log with your own application logs (see the Essential Log Entries for AI‑Powered Tools that Call External APIs guide) to create a full‑trace view of the agent’s activity.

When to prefer a personal access token over a GitHub App?

Personal access tokens (PATs) are simpler but grant broader access and are long‑lived. Use a PAT only for quick prototypes or when the platform does not support JWT‑based flows. In production, a GitHub App is the recommended, zero‑trust approach.

Key takeaways

• Use a GitHub App with repository‑level permissions instead of a PAT.
• Generate short‑lived installation tokens and rotate them automatically.
• Log every GitHub API call and correlate with your AI‑agent logs.
• Implement a revocation workflow for rapid response to anomalies.

Following these steps lets small teams enjoy the productivity boost of AI coding agents while keeping the rest of their codebase and secrets locked down. If you need a hands‑on review of your current setup, AISecAll can help you harden the integration.