Let AI Agents Open PRs and Issues on GitHub

Overview

OneCLI connects AI agents to GitHub so they can read and write code, open pull requests, manage issues, and trigger workflows. The gateway injects GitHub credentials into API requests automatically. OneCLI supports two ways to connect GitHub:

Method	Access scope	Best for
OAuth	All repos the user can access	Personal use, quick setup
GitHub App	Only selected repos	Teams, organizations

What you will set up

A GitHub connection through OAuth or a GitHub App
Token injection on API calls and git-over-HTTPS
Per-action allow, ask, or block controls for each agent

Quick example

An agent calling the GitHub API through the gateway, with no token management needed:

# List your repositories
curl -s "https://api.github.com/user/repos?per_page=5&sort=updated" | jq '.[].full_name'

# Create an issue
curl -s -X POST "https://api.github.com/repos/myorg/myrepo/issues" \
  -H "Content-Type: application/json" \
  -d '{"title": "Bug: login page timeout", "body": "The login page times out after 30s on slow connections."}'

# Open a pull request
curl -s -X POST "https://api.github.com/repos/myorg/myrepo/pulls" \
  -H "Content-Type: application/json" \
  -d '{"title": "Fix login timeout", "head": "fix/login-timeout", "base": "main"}'

# Trigger a workflow
curl -s -X POST "https://api.github.com/repos/myorg/myrepo/actions/workflows/deploy.yml/dispatches" \
  -H "Content-Type: application/json" \
  -d '{"ref": "main"}'

The agent makes standard GitHub API calls. The gateway injects the right authentication header automatically: Bearer token for API calls, Basic auth for git-over-HTTPS.

OAuth

Connect your personal GitHub account. The agent gets access to all repositories you can see.

Setup

Go to Connections

Open the OneCLI dashboard and navigate to Connections > GitHub.

Authorize

Click Connect GitHub. You’ll be redirected to GitHub to authorize OneCLI. Review the permissions and click Authorize.

OneCLI connect window for GitHub on Cloud, showing the Connect to GitHub button. — The GitHub connect window on OneCLI Cloud.

Self-hosted: use your own GitHub OAuth app

Skip this section on OneCLI Cloud. It’s only for self-hosted OneCLI without GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET set, or if you want your own company name on GitHub’s consent screen. For the GitHub App, see GitHub App self-hosted.

1. Create the OAuth app

In GitHub, open Settings > Developer settings > OAuth Apps > New OAuth App (use your organization’s settings to own it there). Name it OneCLI and enter your homepage URL.

GitHub Register a new OAuth app form with the name OneCLI, a homepage URL, and the OneCLI callback in the Redirect URI field. — The new OAuth app form, filled in.

2. Add the callback URL

In OneCLI, open Connections > GitHub > Custom credentials and copy the Redirect URI. In GitHub, paste it into Redirect URI and select Register application. GitHub OAuth apps don’t take scopes here: OneCLI requests repo, user, gist, notifications, project, codespace, and workflow when you connect.

OneCLI Custom credentials card for GitHub with the setup guide link, the Redirect URI and its copy button, and the client ID and secret fields. — Copy the Redirect URI from Custom credentials in OneCLI.

3. Connect with your app

Copy the Client ID, then select Generate a new client secret and copy it. Paste both into Connections > GitHub > Custom credentials, select Save & Connect, and authorize in GitHub.

Permissions

The OAuth connection requests these scopes:

Scope	Name	Access
`repo`	Repositories	Read & write (code, issues, PRs)
`user`	Profile	Read (email, name, avatar)
`gist`	Gists	Read & write
`notifications`	Notifications	Read
`project`	Projects	Read & write
`codespace`	Codespaces	Read & write
`workflow`	Actions	Read & write (workflow files)

More about OAuth: how it works, use cases, limitations

How it works

You authorize OneCLI via GitHub’s OAuth flow
OneCLI receives a long-lived access token and encrypts it
When an agent sends a request to api.github.com, the gateway injects the token as a Bearer header
For git operations over HTTPS (github.com), the gateway injects Basic auth credentials

Use cases

Coding agents creating branches, committing code, and opening pull requests
Agents reviewing PRs and leaving comments
Triggering GitHub Actions workflows from an agent
Reading repository contents during code generation

Limitations

The token has access to all repositories you can see, not just selected ones
No organizational visibility or approval flow
Token is long-lived until you revoke the connection

GitHub App

For teams and organizations. A GitHub App gives you repo-level access control and organizational visibility. Org admins can see which repos are connected and approve or revoke access at any time.

Setup

Go to Connections

Open the OneCLI dashboard and navigate to Connections > GitHub App.

Configure credentials (self-hosted only)

If you’re using OneCLI Cloud, skip this step. Platform credentials are pre-configured.For self-hosted deployments, create a GitHub App and enter your App ID, App Slug, and Private Key.

Install the app

Click Connect GitHub App. You’ll be redirected to GitHub where you can:

Select the organization or personal account
Choose All repositories or Only select repositories
Review the permissions

Click Install to complete the connection.

Permissions

The GitHub App requests only the permissions your agents need:

Permission	Access	Description
Contents	Read & write	Code, commits, and branches
Pull requests	Read & write	Create, review, and merge PRs
Issues	Read & write	Create and manage issues
Actions	Read & write	View runs and trigger workflows
Checks	Read & write	Read CI results, create check runs
Commit statuses	Read & write	Read and set status checks
Discussions	Read & write	Read and participate in discussions
Projects	Read & write	Manage project boards
Metadata	Read-only	Repository metadata (always granted)

More about the GitHub App: how it works, use cases

How it works

You install the GitHub App on your organization or account and select which repositories it can access
OneCLI receives the app’s private key and installation ID
The gateway signs a short-lived JWT and exchanges it for an installation access token (1hr TTL)
The token is injected into API requests and automatically refreshed when it expires

Use cases

Organizations giving agents access to specific repos without exposing the full account
Teams where admins need visibility into which repos agents can access
Production deployments where token rotation should be automatic
Compliance environments where long-lived tokens are not acceptable

Managing access

After connecting, you can change which repositories the app can access:

Go to Connections > GitHub App in the OneCLI dashboard
Click Manage on the connection
You’ll be taken to GitHub’s installation settings where you can add or remove repositories

Comparison

	OAuth	GitHub App
Repo access	All repos the user can see	Only selected repos
Token lifetime	Long-lived	1 hour (auto-refreshed)
Org visibility	Not visible to admins	Visible to org admins
Org approval	Not required	Required
Setup	One-click OAuth	Install app + select repos
Best for	Personal, quick start	Teams, production

Per-action permissions

Once connected, the dashboard shows a permissions panel where you control what agents can do with GitHub. Each action has three modes: Allow (green), Ask (yellow, requires human approval), and Block (red, request is rejected). Read-only actions:

Action	Description
List repositories	Browse repos the account can access
Read repository	Read code, commits, branches
List issues	View issues on a repo
List pull requests	View open/closed PRs

Write / delete actions:

Action	Description
Create issue	Open new issues
Create pull request	Open PRs against a repo
Create comment	Comment on issues and PRs
Delete / close	Close issues, delete branches

Use the Read-only preset to allow all read actions and block writes, or switch to Custom to configure each action individually.

Controlling access

Both connection methods are per agent: grant the connection to each agent that needs it, choosing per tool what runs freely, what needs human approval, and what stays blocked — a read-only agent is a single grant. Organization rules add guardrails on top:

Rate limit API calls to stay within GitHub’s rate limits
Require manual approval for destructive operations (e.g., deleting branches)
Scope a connection to specific repositories with a session policy

Everything is checked before credential injection, so a blocked request never touches your GitHub token.

FAQ

How do I keep my GitHub token out of the agent's context?

Don’t set GITHUB_TOKEN or store a token in the agent’s git config. Connect GitHub in OneCLI, and the gateway adds Bearer auth for API calls and Basic auth for git-over-HTTPS at the proxy. See How it works.

OAuth or GitHub App?

OAuth reaches every repo you can access and suits personal use. A GitHub App reaches only selected repos and suits teams. See Comparison.

How do I reconnect or replace the GitHub credential?

Reconnect from Connections > GitHub in the dashboard. Agents with access use the new credential automatically.

Can I require approval before an agent merges or pushes?

Yes. Use per-action permissions when you grant the connection, and rules for organization-wide guardrails.

Cloud integrations

All app connections

LLMs

External Vaults

Let AI Agents Open PRs and Issues on GitHub

Overview

What you will set up

Quick example

OAuth

Setup

Self-hosted: use your own GitHub OAuth app

Permissions

GitHub App

Setup

Permissions

Managing access

Comparison

Per-action permissions

Controlling access

FAQ

​Overview

​What you will set up

​Quick example

​OAuth

​Setup

​Self-hosted: use your own GitHub OAuth app

​Permissions

​GitHub App

​Setup

​Permissions

​Managing access

​Comparison

​Per-action permissions

​Controlling access

​FAQ

Overview

What you will set up

Quick example

OAuth

Setup

Self-hosted: use your own GitHub OAuth app

Permissions

GitHub App

Setup

Permissions

Managing access

Comparison

Per-action permissions

Controlling access

FAQ