# Choose a GitHub credential

> Decide between GitHub App installation authority and GitHub user OAuth for your agent workload.

Constal provides both GitHub authorization modes to every tenant. Use the Constal-managed provider immediately, or install the bring-your-own package when the GitHub App must carry your product's identity and permission policy.

## Comparison {#comparison}

| Question | GitHub App installation | GitHub user OAuth |
| --- | --- | --- |
| Who acts? | The installed GitHub App | A specific GitHub user through the App |
| Best for | Background agents and automation | User-attributed actions |
| External authority | Selected repositories and App permissions | Intersection of App permissions and user access |
| Constal scope | Tenant or customer | Principal, sometimes customer |
| Platform-managed setup | Install the Constal GitHub App | Authorize the Constal GitHub App |
| Bring-your-own setup | App private key | App client secret |
| Output material | Short-lived installation token | User access token plus private refresh state |
| Browser authorization | Installation and repository selection | User consent |

## Use installation authority when {#use-installation}

- the agent must continue when a user leaves;
- an organization selects repositories during App installation;
- operations should be attributed to the App;
- one Credential should represent one customer installation.

Continue with [GitHub App installation credentials](/docs/credentials/integrations/github/github-app.md).

## Use user OAuth when {#use-user-oauth}

- GitHub activity must be attributable to a person;
- effective authority must be constrained by that person's access;
- each user explicitly consents;
- a principal-scoped binding selects the user's grant.

Continue with [GitHub user OAuth credentials](/docs/credentials/integrations/github/github-user-oauth.md).

## Platform-managed and bring-your-own {#ownership}

The Constal-managed installation and OAuth providers are shared platform Resources. Their application secrets are not copied into tenants. Each resulting Credential and scoped binding remains owned by the tenant, customer, or principal that authorized it.

Bring your own GitHub App when downstream customers should see your product's name, permissions, callback, and installation experience. One tenant-owned GitHub App can support both installation credentials and user OAuth credentials; configure its provider instances once, then create one output Credential per installation or user grant.

## Channel sign-in is separate {#channel-sign-in}

These CredentialProviders give agents outbound GitHub authority. They do not restrict who may invoke a Channel. A GitHub organization AuthProvider would authenticate the caller, verify organization membership, return identity evidence, and let Policy gate `channel:receive` and `agent:invoke`.

The authenticated principal or customer can then drive the scoped binding that selects one of these outbound Credentials.