How do you create a clientid/secret for Enterprise?

[ayoung]

I'm having a hard time finding out where to create the ID and secret for Gitify. All the oauth supports require a URL with a webhook or callback.

[stephancom]

+1 for this, some documentation would be very helpful.

[adamu]

You can find it in GHE (v2.11) in Settings → OAuth Applications → Developer Applications. Leaving the callback URL blank seems to work fine.

[netvl]

If you don't specify the callback url, it takes it from the home page url, which is a required field.

Why is requiring OAuth credentials is necessary at all? I was under impression that features available through the regular API (which only requires to generate a token) are the same as for OAuth apps.

[tiii]

I'm also puzzled by this... What are the urls to specify?

[bmeeder22]

I got it to work by just specifying https://www.gitify.io/. After entering that as both the application URL and callback URL I was given the client id and secret, pasted those into gitify, and was then prompted by gitify to login to my enterprise account.

[lilyball]

Is there a reason Gitify can't use a Personal Access Token instead? It seems overkill to create an OAuth app just for myself to get a token.

[lilyball]

Looks like it's not just overkill; Gitify is showing the OAuth login dialog itself rather than deferring to the browser. This is really concerning because it defeats the whole point of OAuth; Gitify is in a position to intercept my username and password. Using the browser would require having a callback URL that actually went back to the app, but that's certainly possible on macOS and I would sure hope it's possible on Windows and Linux too.

Or just use a Personal Access Token and bypass all of this. PATs are used the same way that OAuth tokens are.

[lilyball]

Actually this issue affects regular GitHub too; I hadn't tried it before, but it's doing the same in-app browser window for login there, which means it's in a position to steal my GitHub username/password.

[bmulholland]

Personal access tokens are supported now, so this is maybe completed? I've also started work on moving OAuth to happen in a normal browser. See #654. Help is very welcomed.

There's several other issues about the OAuth login process linked in that PR, so closing this one as completed/duplicate.

Let me know if I'm missing a detail.