Keep your OpenAI API key on your server, and authorize GitHub separately through a GitHub App user-authorization flow. After the user consents, your application can make GitHub requests with that user’s access token. The agent does not need to see either raw credential: OpenAI’s Agents API vaults documentation describes storing OAuth grants and proxying credentials so sandbox code can use a placeholder instead of the secret.
Keep OpenAI and GitHub credentials separate
An OpenAI API key authenticates your application to OpenAI; it does not grant access to a user’s GitHub repositories. OpenAI says an API key is secret: keep it in server-side configuration, such as an environment variable or key-management service, and never expose it in browser code, an agent prompt, or tool output. See OpenAI API authentication.
As an Amazon Associate I earn from qualifying purchases.
For GitHub actions performed on a user’s behalf, use a separate authorization flow. A GitHub App can obtain a user access token after that user authorizes it. GitHub then attributes requests made with the user token to that user, subject to the user’s access and the app’s permissions. This is delegated GitHub access—not an OpenAI API key. See GitHub App user authorization.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Set up the authorization and request path
- Keep the OpenAI key on your backend. Make OpenAI requests from server-side code and load the key from a server environment variable or a key-management service. Do not send it to browser JavaScript or include it in content the agent can inspect.
- Create a GitHub App with only the permissions the workflow needs. GitHub App user tokens use fine-grained permissions. A token’s effective access is constrained by both the app’s granted permissions and the authorizing user’s access.
- Obtain user consent using an appropriate flow. GitHub documents a web application flow for browser-based apps and a device flow for headless clients or clients without a browser. In a web flow, validate the returned
stateagainst the value you sent and abort if it does not match. GitHub strongly recommends PKCE for the code exchange. For a hosted web application, keep the client secret and token exchange on the server. Follow GitHub’s user access token guide for the flow and token details. - Limit repository reach when appropriate. GitHub documents a
repository_idparameter that can restrict a user access token to one repository the user and app can already access. Confirm repository access through GitHub’s installation and repository APIs; do not assume that a user can reach every repository in an account. - Keep the GitHub grant out of agent-visible content. Store and use the grant in trusted application infrastructure. OpenAI’s Agents API vault documentation describes storing OAuth grants with
auth.type: "mcp_oauth"; the application handles the provider’s consent flow and can configure expiry and refresh-token behavior. For sandbox commands, the guide also describes environment credentials whose real value is injected by a proxy for requests to an allowed host. Sandbox code sees a placeholder, not the secret. - Refresh or revoke access deliberately. GitHub documents a default eight-hour lifetime for user access tokens and a six-month lifetime for refresh tokens when expiration is enabled. An authorized app can refresh an access token. Protect both token types, and stop making requests for a user when that user revokes authorization.
Understand what the token can reach
A GitHub App user token is limited by the intersection of the user’s access and the app’s permissions, and the app must be installed in the account that contains the resource. For example, installing the app only on a user’s personal account does not by itself authorize access to an organization repository simply because that user belongs to the organization. Members who need user-attributed actions must authorize the app.
#1 Best Overall
Before enabling a workflow, decide which actor should appear in GitHub’s activity history. Requests using a user access token are attributed to the user. Installation authentication attributes activity to the app instead. Use user authorization when actions should be performed on behalf of a consenting user; use installation authentication when the app itself should be the actor. GitHub explains the distinction in its user authorization documentation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Keep raw secrets out of the sandbox
A vault or credential proxy can mediate access without revealing a raw token to sandbox code. That approach works when the sandbox only needs to send an authenticated request to an allowed host and the proxy can inject the credential. It does not work for an operation that requires the sandbox to inspect the secret or use it for local signing or computation: a placeholder is not the real credential. In that case, keep the operation in trusted application code and expose it to the agent through a function tool.
Regardless of where credentials are stored, treat GitHub access and refresh tokens as secrets. Restrict the destinations to which a proxy may attach credentials, grant only necessary permissions, and honor revoked consent by ceasing requests for that user.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
