docs/translations/ru-RU/content/developers/apps/authenticating-with-github-apps.md

title, intro, redirect_from, versions

title	intro	redirect_from	versions
Authenticating with GitHub Apps	{{ site.data.reusables.shortdesc.authenticating_with_github_apps }}	/apps/building-integrations/setting-up-and-registering-github-apps/about-authentication-options-for-github-apps/ /apps/building-github-apps/authentication-options-for-github-apps/ /apps/building-github-apps/authenticating-with-github-apps	free-pro-team enterprise-server * *

{% if currentVersion != "free-pro-team@latest" and currentVersion ver_lt "enterprise-server@2.22" %} {{ site.data.reusables.pre-release-program.machine-man-preview }} {{ site.data.reusables.pre-release-program.api-preview-warning }} {% endif %}

Generating a private key

After you create a GitHub App, you'll need to generate one or more private keys. You'll use the private key to sign access token requests.

You can create multiple private keys and rotate them to prevent downtime if a key is compromised or lost. To verify that a private key matches a public key, see Verifying private keys.

To generate a private key:

{{ site.data.reusables.user-settings.access_settings }} {{ site.data.reusables.user-settings.developer_settings }} {{ site.data.reusables.user-settings.github_apps }} {{ site.data.reusables.user-settings.modify_github_app }} 5. In "Private keys," click Generate a private key. 6. You will see a private key in PEM format downloaded to your computer. Make sure to store this file because GitHub only stores the public portion of the key.

{% note %}

Note: If you're using a library that requires a specific file format, the PEM file you download will be in PKCS#1 RSAPrivateKey format.

{% endnote %}

Verifying private keys

{{ site.data.variables.product.product_name }} generates a fingerprint for each private and public key pair using a SHA-1 hash function. You can verify that your private key matches the public key stored on {{ site.data.variables.product.product_name }} by generating the fingerprint of your private key and comparing it to the fingerprint shown on {{ site.data.variables.product.product_name }}.

To verify a private key:

1. Find the fingerprint for the private and public key pair you want to verify in the "Private keys" section of your {{ site.data.variables.product.prodname_github_app }}'s developer settings page. For more information, see Generating a private key.
2. Generate the fingerprint of your private key (PEM) locally by using the following command:

   $ openssl rsa -in PATH_TO_PEM_FILE -pubout -outform DER | openssl sha1 -c
   

3. Compare the results of the locally generated fingerprint to the fingerprint you see in {{ site.data.variables.product.product_name }}.

Deleting private keys

You can remove a lost or compromised private key by deleting it, but you must have at least one private key. When you only have one key, you will need to generate a new one before deleting the old one.

Authenticating as a {{ site.data.variables.product.prodname_github_app }}

Authenticating as a {{ site.data.variables.product.prodname_github_app }} lets you do a couple of things:

• You can retrieve high-level management information about your {{ site.data.variables.product.prodname_github_app }}.
• You can request access tokens for an installation of the app.

To authenticate as a {{ site.data.variables.product.prodname_github_app }}, generate a private key in PEM format and download it to your local machine. You'll use this key to sign a JSON Web Token (JWT) and encode it using the RS256 algorithm. {{ site.data.variables.product.product_name }} checks that the request is authenticated by verifying the token with the app's stored public key.

Here's a quick Ruby script you can use to generate a JWT. Note you'll have to run gem install jwt before using it.

require 'openssl'
require 'jwt'  # https://rubygems.org/gems/jwt

# Private key contents
private_pem = File.read(YOUR_PATH_TO_PEM)
private_key = OpenSSL::PKey::RSA.new(private_pem)

# Generate the JWT
payload = {
  # issued at time
  iat: Time.now.to_i,
  # JWT expiration time (10 minute maximum)
  exp: Time.now.to_i + (10 * 60),
  # {{ site.data.variables.product.prodname_github_app }}'s identifier
  iss: YOUR_APP_ID
}

jwt = JWT.encode(payload, private_key, "RS256")
puts jwt

YOUR_PATH_TO_PEM and YOUR_APP_ID are the values you must replace.

Use your {{ site.data.variables.product.prodname_github_app }}'s identifier (YOUR_APP_ID) as the value for the JWT iss (issuer) claim. You can obtain the {{ site.data.variables.product.prodname_github_app }} identifier via the initial webhook ping after creating the app, or at any time from the app settings page in the GitHub.com UI.

After creating the JWT, set it in the Header of the API request:

{% if currentVersion != "free-pro-team@latest" and currentVersion ver_lt "enterprise-server@2.22" %}

$ curl -i -H "Authorization: Bearer YOUR_JWT" -H "Accept: application/vnd.github.machine-man-preview+json" {{ site.data.variables.product.api_url_pre }}/app

{% else %}

$ curl -i -H "Authorization: Bearer YOUR_JWT" -H "Accept: application/vnd.github.v3+json" {{ site.data.variables.product.api_url_pre }}/app

{% endif %}

YOUR_JWT is the value you must replace.

The example above uses the maximum expiration time of 10 minutes, after which the API will start returning a 401 error:

{
  "message": "'Expiration' claim ('exp') must be a numeric value representing the future time at which the assertion expires.",
  "documentation_url": "{{ site.data.variables.product.doc_url_pre }}/v3"
}

You'll need to create a new JWT after the time expires.

Accessing API endpoints as a {{ site.data.variables.product.prodname_github_app }}

For a list of REST API endpoints you can use to get high-level information about a {{ site.data.variables.product.prodname_github_app }}, see "GitHub Apps."

Authenticating as an installation

Authenticating as an installation lets you perform actions in the API for that installation. Before authenticating as an installation, you must create an installation access token. These installation access tokens are used by {{ site.data.variables.product.prodname_github_app }}s to authenticate.

By default, installation access tokens are scoped to all the repositories that an installation can access. You can limit the scope of the installation access token to specific repositories by using the repository_ids parameter. See the Create an installation access token for an app endpoint for more details. Installation access tokens have the permissions configured by the {{ site.data.variables.product.prodname_github_app }} and expire after one hour.

To create an installation access token, include the JWT generated above in the Authorization header in the API request:

{% if currentVersion != "free-pro-team@latest" and currentVersion ver_lt "enterprise-server@2.22" %}

$ curl -i -X POST \
-H "Authorization: Bearer YOUR_JWT" \
-H "Accept: application/vnd.github.machine-man-preview+json" \
{{ site.data.variables.product.api_url_pre }}/app/installations/:installation_id/access_tokens

{% else %}

$ curl -i -X POST \
-H "Authorization: Bearer YOUR_JWT" \
-H "Accept: application/vnd.github.v3+json" \
{{ site.data.variables.product.api_url_pre }}/app/installations/:installation_id/access_tokens

{% endif %}

The response will include your installation access token, the expiration date, the token's permissions, and the repositories that the token can access. For more information about the response format, see the Create an installation access token for an app endpoint.

To authenticate with an installation access token, include it in the Authorization header in the API request:

{% if currentVersion != "free-pro-team@latest" and currentVersion ver_lt "enterprise-server@2.22" %}

$ curl -i \
-H "Authorization: token YOUR_INSTALLATION_ACCESS_TOKEN" \
-H "Accept: application/vnd.github.machine-man-preview+json" \
{{ site.data.variables.product.api_url_pre }}/installation/repositories

{% else %}

$ curl -i \
-H "Authorization: token YOUR_INSTALLATION_ACCESS_TOKEN" \
-H "Accept: application/vnd.github.v3+json" \
{{ site.data.variables.product.api_url_pre }}/installation/repositories

{% endif %}

YOUR_INSTALLATION_ACCESS_TOKEN is the value you must replace.

Accessing API endpoints as an installation

For a list of REST API endpoints that are available for use by {{ site.data.variables.product.prodname_github_app }}s using an installation access token, see "Available Endpoints."

For a list of endpoints related to installations, see "Installations."

HTTP-based Git access by an installation

Installations with permissions on contents of a repository, can use their installation access tokens to authenticate for Git access. Use the installation access token as the HTTP password:

git clone https://x-access-token:<token>@github.com/owner/repo.git