Deprecating OAuth Authorization API

As mentioned in this previous blog post, GitHub has deprecated the OAuth authorization endpoints and recommends that integrators switch to the web application flow to generate access tokens.

Since the OAuth Authorization API requires password authentication, this API will not work once password authentication has been deprecated.

This deprecation has not been applied to GitHub Enterprise offerings, yet. Though, we still recommend GHES customers to make the changes in their applications, if possible. Please check the latest Enterprise release notes to learn when deprecation is initiated and on which GHES version OAuth Authorization API will be removed.

Deprecation timeline

Removal date

All calls to the OAuth authorization endpoints will return a status code of 404 starting on:

• November 13, 2020 at 16:00 UTC

Brownouts

During a brownout, calls to the old version of the OAuth Authorization API will temporarily fail. The goal is to trigger alerts (assuming there are any) on our customers' services to help find unmigrated endpoint calls.

The brownouts are scheduled for:

• September 30, 2020

  • From 07:00 UTC to 10:00 UTC
  • From 16:00 UTC to 19:00 UTC

• October 28, 2020

  • From 07:00 UTC to 10:00 UTC
  • From 16:00 UTC to 19:00 UTC

Changes to make

Calls to OAuth Authorizations API

If you're making OAuth Authorization API calls to manage your OAuth app's authorizations or to create personal access or OAuth tokens like:

curl -u my_username:my_password -X POST "https://api.github.com/authorizations" -d '{"scopes":["public_repo"], "note":"my token", "client_id":"my_client_id", "client_secret":"my_client_secret"}'

Then you must switch to the web application flow to generate access tokens.

Endpoints affected

The following list of OAuth authorization endpoints are deprecated:

• GET /authorizations
• GET /authorizations/:authorization_id
• POST /authorizations
• PUT /authorizations/clients/:client_id
• PUT /authorizations/clients/:client_id/:fingerprint
• PATCH /authorizations/:authorization_id
• DELETE /authorizations/:authorization_id
• GET /applications/grants
• GET /applications/grants/:grant_id
• DELETE /applications/grants/:grant_id

If you have any questions or feedback, please let us know!