Skip to content

GitHub App creation callback for the setup wizard

Public-safe

Where GitHub returns after the operator creates the App. The one-time code is exchanged for the App's private key and webhook secret, so the redirect origin comes from PUBLIC_API_ORIGIN rather than the request's Host header — a spoofed Host would otherwise send the callback, and the credentials, somewhere else.

Responses

  • 200
    The App was created and its credentials were persisted
  • 400
    No `code` parameter, or the wizard is not configured
  • 403
    The `state` parameter did not match the one issued
  • 500
    GitHub rejected the code exchange
Submit the setup token from the wizard's formThe redacted, checksummed corpus behind one rule's published precision — downloadable without credentials