GitHub

the platform reads your GitHub organization’s members through the GitHub REST API so you can review who has access. Connecting with Connect (OAuth) is the recommended method and requires no token management. A personal access token is also available if you would rather not authorize an OAuth App.

attention to

If your organization restricts third-party OAuth App access, an owner must grant the platform access before the organization appears in the picker.

Prerequisites

• the platform organization administrator access
• Membership in the GitHub organization you want to review, since GitHub or a token can only read organizations it belongs to
• If your organization restricts OAuth App access (Settings > Third-party Access > OAuth app policy in the organization), an owner must approve the platform before it appears in the organization picker
• For the personal access token option: the Organization slug, the part of github.com/<organization>, which the Connect dialog asks for since a token has no picker

Collected Fields

the platform field	GitHub field	Notes
Name	name	Falls back to the member’s login when the profile has no name set
Email	email	GitHub keeps a member’s email private by default. the platform records whatever the public profile exposes and leaves it empty otherwise
Role	role	The organization membership role, admin or member
Admin	role	Flagged as administrator when role is admin
Status	state	Active when the membership state is active. Pending invitations are not collected
MFA	filter=2fa_disabled	Reading this requires the connected account to hold the organization owner role. the platform marks MFA Unknown for every member when GitHub rejects that request
Last login	Not supported
External ID	id	Stable identifier used to track the account across reviews
Created at	created_at	When the member’s GitHub account was created, not when they joined the organization

Members whose type is Bot are recorded as service accounts. the platform still records their organization membership role and admin status.

Connect GitHub

Option A: Connect with GitHub (recommended)

1. In the platform, go to Access Reviews > Sources > Add Source.
2. Find GitHub and click Connect.
3. Authorize the platform on GitHub. the platform requests the read:org scope.
4. On the new source row, pick your organization from the Select organization dropdown.

If the dropdown shows GitHub returned no organizations, click Review the platform’s access, ask an organization owner to approve the platform under Organization Settings > Third-party Access > OAuth app policy, then reopen the dropdown.

Option B: Personal Access Token

1. In GitHub, signed in as a member of the organization, go to Settings > Developer settings > Personal access tokens > Fine-grained tokens, and create one scoped to the organization with the Members organization permission set to Read-only. A classic token (Tokens (classic)) with the read:org scope also works.
2. Copy the token and store it securely. GitHub shows it only once.
3. In the platform, go to Access Reviews > Sources > Add Source, find GitHub, open the dropdown next to Connect, and click Connect with API Key.
4. Paste the token, enter your Organization (the slug from github.com/<organization>), and click Connect.

the platform names the source after your GitHub organization and pulls its members into your campaigns.

Troubleshooting

• The organization picker is empty. When an organization restricts third-party OAuth App access, GitHub omits it from GET /user/orgs until an owner approves the platform. Click Review the platform’s access on the source row, or ask an owner to approve the platform under Organization Settings > Third-party Access > OAuth app policy.
• Token rejected or no members appear. Confirm the token has the read:org scope (classic) or the Members: Read-only permission (fine-grained), and that it belongs to a member of the organization entered in Organization.
• MFA shows Unknown for every member. Reading two-factor status requires the connected account to hold the organization owner role. the platform falls back to Unknown for the whole review when GitHub rejects that request.
• Emails are empty. GitHub keeps a member’s email private by default. the platform cannot read an email the member has not made public.
• A pending invitation is missing. GitHub’s members endpoint only returns current organization members. the platform does not collect pending invitations.