Deprecating OAuth Application API
As mentioned in this previous blog post, GitHub no longer supports the OAuth application endpoints and have replaced them with a version that moves the access token to the request body for improved security.
This deprecation has not been applied to GitHub Enterprise offerings yet. Please check the latest Enterprise release notes to learn when this deprecation is initiated and which version of GitHub Enterprise Server will have the OAuth Application API removed.
As an alternative to authorizing your app, you can use the web application flow or the device flow. The device flow doesn't require using the client_secret
and can be used by headless apps. For more information, see "Authorizing OAuth Apps."
Deprecation timeline
Brownouts
During a brownout, calls to the old version of OAuth application endpoints will temporarily fail. The goal is to trigger alerts (assuming there are any) on our customers' services to help find unmigrated endpoint calls.
The brownouts are scheduled for:
-
March 17, 2021
- From 07:00 UTC to 10:00 UTC
- From 16:00 UTC to 19:00 UTC
-
April 14, 2021
- From 07:00 UTC to 10:00 UTC
- From 16:00 UTC to 19:00 UTC
Removal date
All calls to the old version of the OAuth application endpoints will return a status code of 404 starting on:
- May 5, 2021 at 16:00 UTC
Changes to make
Using calls to OAuth Application API
If you're using the version of the OAuth Application API that includes :access_token
in the path like:
curl -u my_client_id:my_client_secret -X POST "https://api.github.com/applications/123/tokens/my_access_token"
Instead, you'll need to call the new version that moves :access_token
in the request body:
curl -u my_client_id:my_client_secret -X PATCH "https://api.github.com/applications/123/token -d {"access_token": "my_access_token"}"
See the list of OAuth application endpoints below that you'll need to replace with the new endpoints.
Endpoints affected
The following list of OAuth Application endpoints are deprecated and should be replaced with the new corresponding endpoints.
If you have any questions or feedback, please let us know!