Skip to main content

Sign in with GitHub

How to register Curupira as a GitHub OAuth App so your tenant's users can sign in with GitHub.

Portal: github.com/settings/developers → OAuth Apps → New OAuth App (for an org-owned app: Org → Settings → Developer settings → OAuth Apps).

ℹ️ Create an OAuth App, not a GitHub App — they're different products. Curupira uses the classic OAuth App web flow.

Curupira detailValue
TypeOAuth2 (no id_token; identity from GET /user)
Callback URL to registerhttps://auth.curupira.api.br/sso/github/callback
Default scopesread:user user:email

:::info Why user:email is required Curupira makes a second call to GET /user/emails to read the primary, verified email — so the user:email scope must stay (a private primary email still works). If that email isn't verified on GitHub, Curupira's verified-email check refuses the link. :::

1 · Register the OAuth App​

New OAuth App and fill:

FieldWhat to put
Application nameYour app's name
Homepage URLhttps://curupira.api.br
Authorization callback URLhttps://auth.curupira.api.br/sso/github/callback (paste exactly)

GitHub matches the callback URL character-for-character. Register application.

2 · Generate a client secret​

  • The Client ID is shown on the app page — copy it.
  • Click Generate a new client secret, then copy the value immediately (GitHub shows it once).

3 · Add the connection in Curupira​

In the admin dashboard → SSO Connections, choose your tenant and Add SSO Connection:

  • Provider: GitHub
  • Client ID / Client Secret: from step 2 (the secret is stored encrypted and never shown again)
  • Scopes: leave blank to use the defaults (read:user user:email) — keep user:email
  • Enabled: on

Then test at https://auth.curupira.api.br/sso/github/authorize?tenant=<your-tenant-slug>.

:::note Account linking If GitHub returns an email that matches an existing password account, sign-in is refused — sign in with your password first, then connect SSO from your account settings. A brand-new verified email creates an SSO-only user automatically. :::

Checklist​

  • Created an OAuth App (not a GitHub App)
  • Homepage https://curupira.api.br
  • Authorization callback https://auth.curupira.api.br/sso/github/callback (exact)
  • Client ID + Client Secret copied
  • Scopes keep user:email (needed for the verified-email check)
  • Entered in SSO Connections