Back to Overview

Configure GitHub OAuth Sign-In for Tymeslot

Let users sign in with their GitHub account. Setup takes a few minutes and needs only read access to their email addresses.

Luka Breitig, Software Engineer & AI Developer
Luka Breitig

Updated 11 March 2026

Before you begin

  • A GitHub account
  • A domain with HTTPS configured
  • Tymeslot installed and running at your domain

By the end of this guide, users can sign in to Tymeslot with their GitHub account. GitHub is the simplest OAuth provider to set up: there is no consent screen to get reviewed and no API to enable.

1 Create a GitHub OAuth App

  1. Go to github.com/settings/developers (or go there from your GitHub avatar → [Settings] → [Developer settings]).
  2. Click [OAuth Apps] in the left sidebar, then [New OAuth App].
  3. Fill in the form:
    • • Application name: "Tymeslot", the name users see on GitHub's authorisation screen.
    • • Homepage URL: https://yourdomain.com
    • • Authorization callback URL: https://yourdomain.com/auth/github/callback
  4. Click [Register application]. You land on the app's settings page.

Organisation-owned apps

To have a GitHub organisation own the OAuth app instead of your personal account, create it from the organisation's settings: [Your organisation] → [Settings] → [Developer settings] → [OAuth Apps]. The remaining steps are the same.

2 Generate a Client Secret

  1. On the app settings page, click [Generate a new client secret].
  2. GitHub displays the secret value once. Copy it immediately.

Copy the secret before leaving the page

Once you navigate away, GitHub no longer shows the full secret value. If you lose it, click [Delete] next to the secret and generate a new one. This does not change your Client ID or any other app setting.

3 Copy Your Client ID

Your Client ID is shown at the top of the app settings page, above the client secrets section. Unlike the secret, it stays visible, so you can come back for it at any time.

4 Configure Environment Variables

Add the following to your Tymeslot environment and restart it. 

# Enable GitHub Login
ENABLE_GITHUB_AUTH=true

# OAuth credentials (from Steps 2 and 3)
GITHUB_CLIENT_ID=your-client-id
GITHUB_CLIENT_SECRET=your-client-secret

After the restart, a GitHub button appears on the sign-in and sign-up pages. Because the variable is set, the admin panel's Authentication tab shows GitHub sign-in greyed out. To switch it from there instead, without a restart, leave ENABLE_GITHUB_AUTH out.

What Users Experience

When a user clicks the GitHub button, GitHub asks them to authorise access to their profile and email addresses (the user:email scope). Tymeslot asks for no repository, organisation or code access.

The first time someone signs in with GitHub, Tymeslot takes them to a short sign-up form using the verified email address GitHub reports. After that, the GitHub button signs them straight in. Tymeslot does not attach GitHub to an existing account: if someone already signed up with that email using a password or another provider, they keep signing in that way.

Users with private email addresses

GitHub lets users keep their email address private, in which case the profile API returns no email. Tymeslot therefore always reads the user's verified addresses from GitHub's email endpoint, which the same scope covers. If the account has no verified address at all, the user types an email address into Tymeslot and confirms it through a link Tymeslot sends.

Common Errors

Login redirects back to the login page with an error

The most common cause is a mismatch between the Authorization callback URL registered in GitHub and the URL Tymeslot uses. They must match exactly: same scheme (https://), same domain, same path, and no trailing slash. Open your GitHub OAuth App settings and confirm the callback URL matches https://yourdomain.com/auth/github/callback exactly.

The GitHub button does not appear

Confirm that ENABLE_GITHUB_AUTH=true is set in your environment and that you restarted Tymeslot after adding it, because environment variables are only read at startup. If the variable is unset, check that an admin has not switched GitHub sign-in off in the admin panel's Authentication tab.

Sign-in fails for one user but works for others

The usual cause is an email address that already belongs to a Tymeslot account created another way, so ask the user to sign in with their password or original provider. Otherwise, ask them to check their GitHub email settings at github.com/settings/emails and confirm they have at least one verified email address.

❓ Frequently Asked Questions

GitHub login redirects back to an error page. What's wrong?

The most likely cause is a mismatch between the Authorization callback URL registered in your GitHub OAuth App and the URL Tymeslot sends during the OAuth flow. The value in GitHub must be exactly https://yourdomain.com/auth/github/callback , with the same scheme, domain and path, and no trailing slash. Open your app at github.com/settings/developers and verify the callback URL character-for-character.

Users can log in with GitHub, but their email isn't showing up. Why?

GitHub lets users keep their email address private, in which case the profile API returns no email. Tymeslot reads the address from GitHub's /user/emails endpoint instead, which lists the user's verified addresses. If a user has no verified email address on GitHub, Tymeslot asks them for one and confirms it by email before creating the account.

Can I restrict GitHub login to users from my organization?

No. GitHub OAuth Apps cannot limit sign-in to members of an organisation, so any GitHub user can authorise the app. To stop strangers creating accounts, turn registration off with REGISTRATION_ENABLED=false; existing users can still sign in with GitHub, but new ones cannot sign up through it.

I created the OAuth App, but I'm getting a 'client_id not found' error. Why?

Double-check that the GITHUB_CLIENT_ID environment variable contains the Client ID shown at the top of your GitHub OAuth App settings page, copied in full with no surrounding spaces or quotes. It is an alphanumeric string (newer OAuth Apps have IDs starting Ov23). If you created a GitHub App instead of an OAuth App, do not use its numeric App ID.

Do I need to publish or submit my GitHub OAuth App for review?

No. GitHub OAuth Apps need no review or publishing and work for any GitHub user as soon as you create them. There is no separate testing mode, unlike Google's consent screen.

Verification Checklist

Confirm each of the following after restarting Tymeslot:
  • A GitHub button appears on the sign-in and sign-up pages.
  • Clicking it opens GitHub's authorisation screen, which names the app "Tymeslot".
  • After you authorise it, GitHub sends you back to Tymeslot, which signs you in (or, the first time, shows the sign-up form).
  • Your Tymeslot account uses the verified email address from your GitHub account.
  • The GitHub OAuth App settings page at github.com/settings/developers shows a non-zero count next to Users.

🔗 Related Articles

Read Google OAuth App Setup

Google OAuth App Setup

Set up a Google OAuth app in Google Cloud Console. One app powers Google Login, Calendar sync, and Meet rooms for Tymeslot. Covers API enabling and consent screen.

Read Microsoft Azure App Setup

Microsoft Azure App Setup

Register an Azure app for Tymeslot. Enables Outlook Calendar sync and Teams meetings. Covers API permissions and admin consent requirements.

Read Generic SSO (OAuth / OIDC)

Generic SSO (OAuth / OIDC)

Connect any OAuth 2.0 / OpenID Connect identity provider for single sign-on. Supports Keycloak, Authentik, Lemonldap::NG, Okta, Azure AD, and more.