GitHub

1. In your zone’s Keycard Console, go to Resources -> Explore Resources.

2. Search for GitHub and click into the catalog entry.

3. The install dialog shows a Redirect URI. Copy it - you’ll paste it into GitHub in Step 2. Leave this Keycard tab open.

1. Go to GitHub App Settings
2. Click New GitHub App
3. Fill in:
   • GitHub App name: A descriptive name (e.g., “Keycard”)
   • Homepage URL: Your application URL (e.g., http://localhost:3000)
   • Callback URL: The redirect URI provided by Keycard
4. Under Permissions, select the permissions your app needs (e.g., Repository → Contents: Read-only)
5. Click Create GitHub App

1. On the app page, note the Client ID
2. Click Generate a new client secret
3. Copy the Client Secret immediately (it’s only shown once)

1. Switch back to the Keycard install dialog you left open in Step 1.

2. Paste the Client ID and Client Secret from Step 2.

3. Click Add GitHub. The resource is provisioned and your app can start exchanging tokens for it.

After installing GitHub, your application exchanges a Keycard-issued access token for a token scoped to this resource. Pass the user’s access token as the subject_token.

from keycardai.oauth import Client, BasicAuth, TokenType
import requests

# Exchange the user's Keycard token for a GitHub token.
with Client(
    "https://<zone-id>.keycard.cloud",
    auth=BasicAuth("<your-client-id>", "<your-client-secret>"),
) as client:
    response = client.exchange_token(
        subject_token=user_access_token,
        subject_token_type=TokenType.ACCESS_TOKEN,
        resource="https://api.github.com",
    )

# Call GitHub directly with the exchanged token.
r = requests.get(
    "https://api.github.com/<endpoint>",
    headers={"Authorization": f"Bearer {response.access_token}"},
)

import { TokenExchangeClient } from "@keycardai/oauth/tokenExchange";

const client = new TokenExchangeClient("https://<zone-id>.keycard.cloud", {
  clientId: "<your-client-id>",
  clientSecret: "<your-client-secret>",
});

const response = await client.exchangeToken({
  subjectToken: userAccessToken,
  resource: "https://api.github.com",
});

// Call GitHub directly with the exchanged token.
const res = await fetch("https://api.github.com/<endpoint>", {
  headers: { Authorization: `Bearer ${response.accessToken}` },
});

See the OAuth SDK → Token Exchange reference for the full client API.

Now do this

• Call GitHub from your code - see the Use GitHub from your code section above for Python and TypeScript samples.

Recommended

• Decide who can use it - write access policies scoped to the GitHub resource so only the right users and apps reach the API.
• Watch the calls - every token exchange and downstream call lands in your audit log with user identity, resource, and policy decision.

Optional

• Add MCP access too - install the GitHub MCP server for AI agents that need GitHub’s tools, not just the REST API.