Connect GitHub to Athena to browse repositories, read code, issues, and pull
requests in chat, power the GitHub toolkit, and inject a short-lived token into
computer environments — all without pasting a personal access token.
You connect GitHub live in the UI. Each repository you connect becomes a
catalog you can open in Drive, reference in chat with @, and use with
Athena’s tools and agents.
What connecting GitHub unlocks
- Browse and read repository contents in Drive, and read files, issues, and
pull requests directly in chat.
- GitHub toolkit in any session — list directories, read files, and more,
with no secret to paste.
- Computer environments — inject a scoped
GITHUB_TOKEN into a computer so
the developer agent can use git, the gh CLI, and the GitHub API.
Choose how you connect
Athena supports four connection methods. We recommend GitHub App — OAuth for
most teams — it gives each member their own GitHub identity through a quick
in-browser sign-in, with fine-grained, org-approved repository access and
automatic token rotation. Pick whichever your organization’s GitHub policies
allow — you can set up more than one (for example, a GitHub App plus a fallback
token).
| Method | How you sign in | Best for |
|---|
| GitHub App — OAuth · Recommended | Authorize in a GitHub popup | The default “sign in with GitHub” experience, with per-user identity and permissions |
| GitHub App — Installation | No sign-in; a shared, org-approved app token | A workspace-wide service connection with fine-grained, org-approved repo access |
| OAuth App | Authorize in a GitHub popup | Organizations that use classic OAuth Apps instead of GitHub Apps |
| Personal Access Token | No sign-in; one shared token | Organizations that don’t allow GitHub Apps or OAuth Apps |
Step 1 — Set up the connection
In Athena, open Integration Definitions
(Workspace Settings → Treasury → Integration Definitions),
click New integration, and choose provider GitHub. Then follow the tab
for the method you picked above.
For every method that uses a GitHub App or OAuth App, the callback URL is:
https://api.athenaintel.com/api/github-direct/oauth/callback
On GitHub
- Create a GitHub App: Organization settings → Developer settings →
GitHub Apps → New GitHub App.
- Set Callback URL to
https://api.athenaintel.com/api/github-direct/oauth/callback.
- Enable “Request user authorization (OAuth) during installation” and
“Expire user authorization tokens” (recommended — this gives Athena
rotating refresh tokens).
- Under Repository permissions, grant Read for Contents,
Pull requests, Issues, and Metadata (add write scopes only
if you need them later).
- Install the App on your organization and choose which repositories it
may access.
- Copy the Client ID and generate a Client secret.
In AthenaSet Auth method to oauth2, paste your Client secret into the
Client secret field, and use this config:{
"name": "GitHub OAuth",
"authorization_url": "https://github.com/login/oauth/authorize",
"access_token_url": "https://github.com/login/oauth/access_token",
"scopes": [],
"connection": { "client_id": "<your client id>" }
}
scopes empty — a GitHub App’s access is defined by the repository
permissions you granted when installing it, not by OAuth scopes. On GitHubUse a GitHub App (create one as in the OAuth tab, or reuse an existing one).
OAuth does not need to be enabled for this method.
- Install the App on your organization and choose which repositories it
may access.
- Copy the App ID.
- Note the Installation ID — the number in the installation’s settings
URL (
.../installations/<installation id>).
- Generate a private key and download the
.pem file.
In AthenaSet Auth method to github_app, paste the full contents of the .pem
into the App private key (PEM) field, and use this config:{
"name": "GitHub App",
"app_id": "<your app id>",
"installation_id": "<your installation id>",
"connection": {}
}
On GitHub
- Create an OAuth App: Organization settings → Developer settings →
OAuth Apps → New OAuth App.
- Set Authorization callback URL to
https://api.athenaintel.com/api/github-direct/oauth/callback.
- Copy the Client ID and generate a Client secret.
(Organization access may require approval under your Third-party
application access policy. Tokens from a classic OAuth App do not expire.)In AthenaSet Auth method to oauth2, paste your Client secret into the
Client secret field, and use this config:{
"name": "GitHub OAuth",
"authorization_url": "https://github.com/login/oauth/authorize",
"access_token_url": "https://github.com/login/oauth/access_token",
"scopes": ["repo", "read:org", "read:user"],
"connection": { "client_id": "<your client id>" }
}
On GitHubCreate a fine-grained personal access token (recommended), scoped to
your organization and repositories with Read access to Contents,
Pull requests, Issues, and Metadata. A classic token with the
repo scope also works. Because this token is shared across the workspace,
a service account is recommended over a personal account.In AthenaSet Auth method to pat, paste the token into the Personal access
token field, and use this config:{
"name": "GitHub PAT",
"connection": {}
}
GitHub Enterprise Server: add your host to the config’s connection
block (e.g. "connection": { "host": "https://github.your-company.com" })
and point the OAuth URLs at that origin. The REST base is derived
automatically as {host}/api/v3.
Step 2 — Connect your repositories
Go to Integrations and
click GitHub → Connect.
- OAuth methods open a GitHub authorization popup, then a repository picker.
- Installation and Personal Access Token methods skip straight to the
repository picker.
Select the repositories you want. Each one becomes a catalog you can open in
Drive, reference in chat with @, and use with the GitHub toolkit and computer
environments.
Your credentials are encrypted at rest, and OAuth connections use per-user
tokens scoped to your own GitHub identity. You can disconnect a repository at
any time from the Integrations page.
