New webhook event for GitHub Apps using User-to-Server tokens

If your GitHub App identifies or authorizes users, those users have the option to revoke the GitHub App authorization from their settings page.

Previously, your GitHub App had no way of knowing when this occurred and may have continued to make User-to-Server requests with the now revoked access token, leading to a 401 Bad Credentials error.

Today, we're introducing the github_app_authorization webhook event, which will be delivered to your GitHub App whenever a user revokes their authorization. The event action is revoked as you can see in the example webhook payload below:

{
  "action": "revoked",
  "sender": {
    "login": "octocat",
    "id": 1,
    "node_id": "MDQ6VXNlcjIxMDMxMDY3",
    "avatar_url": "https://github.com/images/error/octocat_happy.gif",
    "gravatar_id": "",
    "url": "https://api.github.com/users/octocat",
    "html_url": "https://github.com/octocat",
    "followers_url": "https://api.github.com/users/octocat/followers",
    "following_url": "https://api.github.com/users/octocat/following{/other_user}",
    "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
    "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
    "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
    "organizations_url": "https://api.github.com/users/octocat/orgs",
    "repos_url": "https://api.github.com/users/octocat/repos",
    "events_url": "https://api.github.com/users/octocat/events{/privacy}",
    "received_events_url": "https://api.github.com/users/octocat/received_events",
    "type": "User",
    "site_admin": false
  }
}

If you have any questions or feedback, please let us know!