GitHub OAuth Scopes

generated: '2026-11-05'
method: searched
source: https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps
docs: https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps
note: OAuth app scopes; GitHub Apps use fine-grained permissions instead.
scopes:
- name: repo
  description: Grants full access to public and private repositories including read and write access to code, commit statuses, repository invitations, collaborators, deployment statuses, and repository
    webhooks. **Note:** In addition to repository related resources, the `repo` scope also grants access to manage organization-owned resources including projects, invitations, team memberships and webhooks.
    This scope also grants the ability to manage projects owned by users.
- name: repo:status
  description: Grants read/write access to commit statuses in public and private repositories. This scope is only necessary to grant other users or services access to private repository commit statuses
    *without* granting access to the code.
- name: repo_deployment
  description: Grants access to [deployment statuses](/en/rest/repos#deployments) for public and private repositories. This scope is only necessary to grant other users or services access to deployment
    statuses, *without* granting access to the code.
- name: public_repo
  description: Limits access to public repositories. That includes read/write access to code, commit statuses, repository projects, collaborators, and deployment statuses for public repositories and organizations.
    Also required for starring public repositories.
- name: repo:invite
  description: Grants accept/decline abilities for invitations to collaborate on a repository. This scope is only necessary to grant other users or services access to invites *without* granting access to
    the code.
- name: security_events
  description: 'Grants:   read and write access to security events in the [code scanning API](/en/rest/code-scanning)   This scope is only necessary to grant other users or services access to security events
    *without* granting access to the code.'
- name: admin:repo_hook
  description: Grants read, write, ping, and delete access to repository hooks in public or private repositories. The `repo` and `public_repo` scopes grant full access to repositories, including repository
    hooks. Use the `admin:repo_hook` scope to limit access to only repository hooks.
- name: write:repo_hook
  description: Grants read, write, and ping access to hooks in public or private repositories.
- name: read:repo_hook
  description: Grants read and ping access to hooks in public or private repositories.
- name: admin:org
  description: Fully manage the organization and its teams, projects, and memberships.
- name: write:org
  description: Read and write access to organization membership and organization projects.
- name: read:org
  description: Read-only access to organization membership, organization projects, and team membership.
- name: admin:public_key
  description: Fully manage public keys.
- name: write:public_key
  description: Create, list, and view details for public keys.
- name: read:public_key
  description: List and view details for public keys.
- name: admin:org_hook
  description: Grants read, write, ping, and delete access to organization hooks. **Note:** OAuth tokens will only be able to perform these actions on organization hooks which were created by the OAuth
    app. Personal access tokens will only be able to perform these actions on organization hooks created by a user.
- name: gist
  description: Grants write access to gists.
- name: notifications
  description: 'Grants:  read access to a user''s notifications  mark as read access to threads  watch and unwatch access to a repository, and  read, write, and delete access to thread subscriptions.'
- name: user
  description: Grants read/write access to profile info only. Note that this scope includes `user:email` and `user:follow`.
- name: read:user
  description: Grants access to read a user's profile data.
- name: user:email
  description: Grants read access to a user's email addresses.
- name: user:follow
  description: Grants access to follow or unfollow other users.
- name: project
  description: Grants read/write access to user and organization projects.
- name: read:project
  description: Grants read only access to user and organization projects.
- name: delete_repo
  description: Grants access to delete adminable repositories.
- name: write:packages
  description: Grants access to upload or publish a package in GitHub Packages. For more information, see [Publishing a package](/en/packages/learn-github-packages/publishing-a-package).
- name: read:packages
  description: Grants access to download or install packages from GitHub Packages. For more information, see [Installing a package](/en/packages/learn-github-packages/installing-a-package).
- name: delete:packages
  description: Grants access to delete packages from GitHub Packages. For more information, see [Deleting and restoring a package](/en/packages/learn-github-packages/deleting-and-restoring-a-package).
- name: admin:gpg_key
  description: Fully manage GPG keys.
- name: write:gpg_key
  description: Create, list, and view details for GPG keys.
- name: read:gpg_key
  description: List and view details for GPG keys.
- name: codespace
  description: Grants the ability to create and manage codespaces. Codespaces can expose a GITHUB\_TOKEN which may have a different set of scopes. For more information, see [Security in GitHub Codespaces](/en/codespaces/reference/security-in-github-codespaces#authentication).
- name: workflow
  description: Grants the ability to add and update GitHub Actions workflow files. Workflow files can be committed without this scope if the same file (with both the same path and contents) exists on another
    branch in the same repository. Workflow files can expose `GITHUB_TOKEN` which may have a different set of scopes. For more information, see [Use GITHUB\_TOKEN for authentication in workflows](/en/actions/tutorials/authenticate-with-github_token#modifying-the-permissions-for-the-github_token).
- name: read:audit_log
  description: Read audit log data.
- name: offline_access
  description: Requests an expiring access token and a refresh token, even if your OAuth app is not configured to use expiring tokens. Use this scope to test and gradually roll out support for expiring
    tokens. For more information, see [Authorizing OAuth apps](/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps#expiring-access-tokens).