# Prove which GitHub App installations you can reach

> Page: https://docs.plotwork.dev/api/post-github-authorize. Index of every page: https://docs.plotwork.dev/llms.txt

Trades the code GitHub sent the browser back with for a user token, reads the installations of the App that GitHub user can reach, revokes the token, and answers a grant that proves it for ten minutes, to this account only.

`POST /github/authorize`

## TL;DR

| Question | Answer |
|---|---|
| What does it do? | Prove which GitHub App installations you can reach. |
| What does it take? | A JSON body of type [`GithubAuthorizeBody`](https://docs.plotwork.dev/api/schemas.md#githubauthorizebody). |
| What does it return? | Status 200 with a body of type [`GithubAuthorize`](https://docs.plotwork.dev/api/schemas.md#githubauthorize). |
| What can go wrong? | `400` the body is not valid, or GitHub refused the code (github.code_invalid); `401` not signed in; `403` the request came from an origin that may not make changes; `429` too many requests, or GitHub asked to wait (github.rate_limited); `502` GitHub could not be reached (github.unavailable); `503` the GitHub App is not set up on this server (github.not_configured), or organisations are not. Every failure uses the one error envelope. |

## What it does

Trades the code GitHub sent the browser back with for a user token, reads the installations of the App that GitHub user can reach, revokes the token, and answers a grant that proves it for ten minutes, to this account only. No token is stored.

## Request body

The body has the type [`GithubAuthorizeBody`](https://docs.plotwork.dev/api/schemas.md#githubauthorizebody).

| Field | Type | Required | Description |
|---|---|---|---|
| `code` | `string` | yes | The code GitHub sent the browser back with. at least 1 character; at most 200 characters. |
| `codeVerifier` | `string` | no | The PKCE verifier, when the portal started the sign-in with a challenge. at least 43 characters; at most 128 characters; pattern `^[A-Za-z0-9._~-]+$`. |

## Responses

| Status | Meaning | Body |
|---|---|---|
| 200 | The grant and the installations. | [`GithubAuthorize`](https://docs.plotwork.dev/api/schemas.md#githubauthorize) |
| 400 | The body is not valid, or GitHub refused the code (github.code_invalid). | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 401 | Not signed in. | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 403 | The request came from an origin that may not make changes. | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 429 | Too many requests, or GitHub asked to wait (github.rate_limited). | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 502 | GitHub could not be reached (github.unavailable). | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 503 | The GitHub App is not set up on this server (github.not_configured), or organisations are not. | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |

## Response body

A 200 answer has the type [`GithubAuthorize`](https://docs.plotwork.dev/api/schemas.md#githubauthorize).

| Field | Type | Required | Description |
|---|---|---|---|
| `grant` | `string` | yes | Proof, for ten minutes and for this account only, of the installations the GitHub user can reach. Holds no secret. |
| `installUrl` | `string` | yes | Where to install the App, for a GitHub user who can reach no installation of it yet. |
| `expiresAt` | `integer` | yes |  |
| `githubUser` | `object` | yes |  |
| `githubUser.login` | `string` | yes |  |
| `githubUser.id` | `string` | yes |  |
| `installations` | `object[]` | yes |  |
| `installations[].id` | `string` | yes |  |
| `installations[].account` | `object` | yes |  |
| `installations[].account.login` | `string` | yes |  |
| `installations[].account.id` | `string` | yes |  |
| `installations[].account.type` | `"User" \| "Organization"` | yes |  |
| `installations[].repositorySelection` | `"all" \| "selected"` | yes |  |
| `installations[].suspended` | `boolean` | yes |  |
| `installations[].linkedTo` | `object \| null` | yes | The organisation it is linked to, when the caller is a member of it. |
| `installations[].linkedTo.slug` | `string` | yes |  |
| `installations[].linkedTo.name` | `string` | yes |  |
| `installations[].linkedElsewhere` | `boolean` | yes | True when another organisation has it; that organisation is not named. |

## See also

| Doc | Why |
|---|---|
| [API reference](https://docs.plotwork.dev/api/reference.md) | Every endpoint, and the error envelope |
| [Schemas](https://docs.plotwork.dev/api/schemas.md) | Every request and response type |
| [Tool reference](https://docs.plotwork.dev/mcp/tools.md) | The operations as callable tools |