applications VS installations

Go to this link https://github.com/settings/applications/new

🟡 Development app setup Navigate to GitHub OAuth Apps setup https://github.com/settings/developers Create a New OAuth App https://github.com/settings/applications/new Fill in the following details Application name: Azure ChatGPT DEV Environment Homepage URL: http://localhost:3000 Authorization callback URL: http://localhost:3000/api/auth/callback/github 🟢 Production app setup Navigate to GitHub OAuth Apps setup https://github.com/settings/developers Create a New OAuth App https://github.com/settings/applications/new Fill in the following details Application name: Azure ChatGPT Production Homepage URL: https://YOUR-WEBSITE-NAME.azurewebsites.net Authorization callback URL: https://YOUR-WEBSITE-NAME.azurewebsites.net/api/auth/callback/github ⚠️ After completing app setup, ensure your environment variables locally and on Azure App Service are up to date.

Register a new oauth app on github from here

Maybe that's available for you to do again? You will be able to see which apps have access to your github account when you're logged in at: https://github.com/settings/applications

# https://github.com/omniauth/omniauth # https://github.com/settings/applications/new # echo > config/initializers/omniauth.rb # config/initializers/omniauth.rb Rails.application.config.middleware.use OmniAuth::Builder do provider :github, "GITHUB_ID", "GITHUB_SECRET" end

Ouch.

If you're on Github, go to "https://github.com/settings/applications" and you can see, and revoke, any OAuth accesses.

I just discovered that "Improbable" (the game engine backend company) had too much access, obtained because I once signed up to look at their SDK. I revoked that. (They used to be legit, but then they got involved with Yuga Labs, the Bored Ape crypto people, so trusting them is now questionable.)

Now, we need to create a GitHub OAuth app. You can do that from the Github Developer Settings and fill out the information like so:

We can create a GitHub application by navigating to the Settings > Developer settings > OAuth Apps from our profile or simply by clicking here, thus leading us automatically to where we can create the application. From there, we will add the GitHub redirect URL from the Appwrite application to the Authorization callback URL in the application.

Visit the page to register a new app and provide the required details. Application Name: Docusaurus OAuth Example Homepage URL: Whatever heroku open opened in your browser Authorization callback URL: /oauth2/callback

To set up an OAuth app with GitHub, go to Your Profile > Settings > Developer Settings > OAuth Apps > New OAuth App or alternatively, go to this link if you're already logged into GitHub.

To create your connection between Netlify and GitHub you just need to go on netlify user settings and configure the connection with your GitHub account (grant access to all the repos to deploy further projects easily). After doing this, you can navigate to Github Application settings, click on configure, and copy the number appended at the end of the URL since that is your Installation ID. This process will be needed only once, and then you are set to go.

This page https://dash.cloudflare.com/36e5e954c996e147e789df6a1b716209/pages/new/provider/github says ' If your repository is not shown, configure repository access for the Cloudflare Pages app on GitHub. '

Make sure you've installed the DigitalOcean GitHub app as described above—you should see it listed at https://github.com/settings/installations:

That's an interesting concept.

Thinking about it for a bit, I'm sadly hesitant that it might need to be built as a browser extension or mobile app, rather than a website, because none of these services provide programmatically-accessible (even read-only) feeds of what you're looking for, so you'd need to scrape everything. This brings up two issues: 1) the headache of IP ratelimiting (and/or flat-out IP bans from trigger-happy systems optimized for fighting fraud/bots hosted on cloud infrastructure). IIUC there are proxy services that you can outsource the workaround problem to, but this is awkward to get behind in the face of 2), which is that users would need to input their actual usernames and passwords so that the service could request the account page with the details on it in order to scrape the data.

Given that these are broadly web services poked at via HTTPS, you could potentially get everything you needed from a browser extension (as long as the service doesn't require you to set any HTTP headers that extensions aren't allowed to touch).

The second possibility is using an app. Writing a thin layer that lets you craft custom HTTPS/whatever requests from a WebView would probably be the most straightforward approach.

The main issue with both the extension and app approaches is that they code-dump both the idea and methodology of "here is how to do X" into the hands of the IQ-99 skiddie group (especially with an extension). So now you have more people running around scraping pages and whatnot and trying to figure out how to weaponize everything. Probably won't go anywhere (in terms of producing actual attacks), but the noise may potentially make your life harder.

The least-complex solution seems to just be a giant boring list of links, for example:

- https://myaccount.google.com/permissions

- https://twitter.com/settings/connected_apps, https://twitter.com/settings/connected_accounts

- https://github.com/settings/apps/authorizations, https://github.com/settings/applications, https://github.com/settings/installations, https://github.com/settings/apps, https://github.com/settings/developers, https://github.com/settings/tokens

Hmm, that's kind of all over the place for some things. A single aggregate view that combines everything could definitely be very interesting...

Now you should have a private key, App ID (found at the top of your app settings page, https://github.com/settings/apps/yourappname), and Installation ID (via API or in post-install URL like https://github.com/settings/installations/1234567). You can use these to form API requests, either manually, via one of the Octokit libraries, or even as an action.

Look for it later in your GitHub Settings to add more repos, or to revoke access.