Skip to main content


Support level: authentik

Allows users to authenticate using their Github credentials


The following placeholders will be used:

  • is the FQDN of the authentik install.
  • Homepage URL for your site


  1. Create an OAuth app under Developer Settings by clicking on the Register a new application

Register OAuth App

  1. Application Name: Choose a name users will recognize ie: authentik
  2. Homepage URL::
  3. Authorization callback URL:
  4. Click Register Application

Example screenshot

  1. Copy the Client ID and save it for later
  2. Click Generate a new client secret and save it for later You will not be able to see the secret again, so be sure to copy it now.


  1. Under Directory -> Federation & Social login Click Create Github OAuth Source

  2. Name: Choose a name (For the example I use Github)

  3. Slug: github (If you choose a different slug the URLs will need to be updated to reflect the change)

  4. Consumer Key: Client ID from step 6

  5. Consumer Secret: Client Secret from step 7

Here is an example of a complete authentik Github OAuth Source

Save, and you now have Github as a source.


For more details on how-to have the new source display on the Login Page see here.

Checking for membership of a GitHub Organisation


Requires authentik 2021.12.5.

To check if the user is member of an organisation, you can use the following policy on your flows:


Make sure to include read:org in the sources' Scopes setting.

# Ensure flow is only run during oauth logins via Github
if context["source"].provider_type != "github":
return True

accepted_org = "foo"

# Get the user-source connection object from the context, and get the access token
connection = context[""]
access_token = connection.access_token

# We also access the user info authentik already retrieved, to get the correct username
github_username = context["oauth_userinfo"]

# Github does not include Organisations in the userinfo endpoint, so we have to call another URL

orgs_response = requests.get(
auth=(github_username["login"], access_token),
"accept": "application/vnd.github.v3+json"
orgs = orgs_response.json()

# `orgs` will be formatted like this
# [
# {
# "login": "goauthentik",
# [...]
# }
# ]
user_matched = any(org['login'] == accepted_org for org in orgs)
if not user_matched:
ak_message(f"User is not member of {accepted_org}.")
return user_matched

If a user is not member of the chosen organisation, they will see this message