►
Description
Presented by Keavy McMinn, GitHub.
GitHub's Platform offers powerful authentication tools and APIs to build the perfect tool to complete your workflow. Whether you're interested in building an integration for the GitHub Marketplace or scratch an itch by creating a tool for your team, this session will introduce you to GitHub's API, build a real GitHub integration step-by-step, and describe the differences in GitHub's Platform offerings. By the end of this session, you should be able to hit the ground running in building your own integration.
About GitHub Universe:
GitHub Universe is a two-day conference dedicated to the creativity and curiosity of the largest software community in the world. Sessions cover topics from team culture to open source software across industries and technologies.
For more information on GitHub Universe, check the website:
https://githubuniverse.com
A
A
There
are
over
530
endpoints
in
the
github
API,
which
can
be
a
little
intimidating,
but
to
start
with,
so
you
just
want
to
dip
your
toe
in
and
say
hello
to
the
API.
You
can
make
a
request.
The
API
anonymously
to
some
endpoints
like
this
and
one
so
you
literally
type
a
command
in
and
you'll
get
back
a
little
bit
of
wisdom.
A
You
can
make
an
anonymous
request
to
get
information
about
a
user,
and
this
will
return
only
the
information
that
is
public,
so
it'll
be
the
same
information
that
you
might
get
from
the
web.
Ui
you'll
notice
that
there's
some
extra
information
returned
in
the
headers
and
a
couple
of
particular
note
here
or
the
ones
about
create
limits.
So
these
indicate
how
many
requests
you
can
make
in
a
roll
in
time
period,
typically
one
hour
and
how
many
of
those
you've
already
spent
those
limits
are
quite
low
for
these
anonymous
unauthenticated
requests.
A
There's
some
amazing
benefits
of
the
graph
QL
API,
like
a
finer
grained
control
over
queries.
So
if
you're
curious
about
that
do,
go
read
the
developer
site
and
you
can
find
out
more
about
that.
But
for
now
we'll
look
at
the
REST
API,
because
it
works
for
everything
right
now
and
it'll
be
an
easier
starting
point
and
easier
learning
curve.
A
A
A
A
Good
ideas
for
an
OAuth
application
are
something
that
needs
to
act
as
a
github
user,
not
necessarily
you,
but
as
I
github
user
across
all
of
github.
This
is
a
good
idea
for
an
identity
service
like
a
log
in
with
github,
if
an
app
dealt
with
something
like
user
notifications.
That
would
be
a
good
example
of
something
that
needs
to
act
as
a
github
user
across
all
of
github
to
everything
that
user
can
see
bad
ideas
for
a
North
application
and
doing
stuff
on
a
specific
repository.
A
A
If
these
options
cause
you
any
confusion,
you're
not
alone,
and
so
let's
have
a
look
at
how
you
might
decide
which
is
right
for
you,
a
good
starting
point,
I
think,
is
to
ask:
does
this
thing
need
to
only
act
as
me?
If,
yes,
the
next
question
could
be?
Is
it
okay
for
it
to
access
everything
that
I
have
access
to
on
github
like
to
all
my
repositories?
A
A
If
this
would
need
to
act
as
more
than
just
you
would
it
need
to
act
as
the
app
itself?
If,
yes,
then,
a
github
app
is
the
best
solution.
If
no
next
ask
yourself,
is
it
okay
that
this
thing
has
access
to
everything
that
the
authenticated
github
user
has
access
to
and
if
that's,
not,
okay,
the
best
solution
is
github
up,
and
if
that
is
okay
or
even
desired,
an
OAuth
application
would
be
the
right
solution.
A
A
A
So
you
could
then
use
that
token
stored
as
a
variable
in
a
shell
script,
say,
for
example,
in
a
script
that
fetches
your
contributions.
So
you
could
build
up
a
query
that
searches,
maybe
for
your
PRS-
that
you've
merged
over
a
certain
time
frame,
and
this
is
a
particularly
useful
thing
to
do
around
performance
review
time
and
get
maybe
a
list
of
PRS
that
you've
shipped
or
contributed
to
in
some
way
so
building
something
with
the
a
API
doesn't
need
to
be
like
the
next
best
fanciest
CI
service.
A
A
A
Here's
some
possible
examples,
so
I
could
turn
that
contributions
script
into
a
github
of
that
anyone
in
the
team
could
use
and
contribute
to.
So
maybe
my
team
wants
to
make
sure
that
they
value
a
variety
of
contributions
like
PRS,
that
they
people
have
reviewed
and
contributed
to
not
just
things
that
were
shipped
and
we
could
connect
that
to
your
slack
up
so
that
we
could
all
you
just
use
that
with
a
simple
command
right
from
chat.
A
A
So,
there's
a
few
steps
to
build
and
github
up
to
start
with.
You
need
to
create
it
register
it
on
on
github,
so
in
your
sentient
peach,
there's
a
button
and
to
register
a
new
app.
If
you
do
this
from
your
organization
sentence
page,
that
up
would
be
owned
by
the
organization
and
if
you
do
it
from
your
personal
developer
sentence
page
that
would
be
owned
by
yourself
in
Vanara
is
going
to
be
used
by
the
organization.
A
A
It
will
automatically
receive
some
default
events
like
when
it's
been
installed
or
removed
from
an
account,
and
you
should
remember
to
secure
this.
So
do
you
enter
a
secret
here
m
in
the
sentence
and
the
developer
site
has
some
some
guides
on
how
to
check
that
the
incoming
data
to
make
sure
that
that's
coming
from
github?
A
Otherwise,
you
could
risk
taking
actions
based
on
data
that
isn't
legit
that
hasn't
actually
come
from
github
and
another
tip
about
those
web
hooks
settings
and
you
could
use
a
service
like
request
bin
here
as
a
temporary
web
hook,
URL
for
your
github
app
and
from
that
site,
you
could
see
the
details
of
all
the
requests
that
are
sent
to
that
URL.
So
that's
a
cool
way
to
get
up
and
running
and
just
experiment
and
explore
the
data
before
maybe
you're,
even
ready
to
host
this
thing
somewhere.
A
If
you
are
doing
something
like
this
in
sand
and
data
to
a
third-party
service
and
isn't
secure,
just
be
aware,
did
not
send
any
data
from
private
repositories
also
in
the
Advanced
Settings
page
of
a
github
app,
you
can
check
in
on
what
has
been
sent.
So
you
can
see
the
data
that's
sent
to
your
web
hook,
URL
from
there
and
even
request
that
it's
redelivery.
A
The
next
part
of
the
form
you'd
fill
out
is
to
select
what
permissions
your
app
would
need.
So
for
the
kind
of
workflow
examples
we've
just
looked
at
these
are
the
permissions
we'd
need
so
you'd
get
repository,
be
able
to
see
sort
of
metadata
about
repository
for
free.
We
would
like
to
be
able
to
read
and
write
some
issues,
but
only
read,
pull
requests
and
also
read
information
about
the
members
in
the
organization.
A
So
next
you
would
configure
your
app,
but
first,
let's
just
took
a
quick
high-level
look
at
the
pieces
of
this
again,
so
you
have
your
app,
which
gets
installed
on
on
the
kind,
whether
a
user,
a
kind
or
an
organization,
a
kind
and
gets
access
to
whatever
repositories
that
the
user
has
specified.
Each
installation
here
has
no
idea
about
any
other
installations
that
the
app
has
access
to.
A
So
for
the
app
itself.
You
might
want
to
ask
the
API
these
kind
of
questions
like
what
installations
do.
I
have
give
me
a
token
for
this
installation
who
even
am
I
and
when
asking
those
high-level
questions
of
the
API
you'd
want
to
authenticate
as
the
app
which
means
using
a
private
key
that
you
generated
back
in
their
app
settings
page.
A
A
So
here
I'm
using
the
Arctic
ID
client,
which
is
a
handy
wrapper
for
the
API
and
passing
it
that
JWT
token
and
then
I
can
use
that
client,
which
holds
the
authentication
as
the
app
to
make
API
requests.
As
that
up,
an
installation
is
the
part,
that's
concerned
with
specific
repositories
and
anything
within
them.
So
an
installation
might
want
to
ask
the
API
questions
like
these,
like
what
repositories
can
I
work
with?
What
are
the
latest
pr's
in
this
repo?
A
A
A
But
the
installation
looks
correct
to
me
and
the
token
was
legit
keeping
in
mind
that
I
have
access
to
all
the
API
code
and
obviously
github
app
that
I'm
building,
so
I
can
see
all
of
the
things
and
debug
at
all
these
stages,
and
but
I
could
not
figure
out
why
I
was
getting
unauthorized
errors
and
it
turned
out.
I
was
authenticating
as
an
installation
for
an
endpoint
that
needed
that
higher-level
app
app
authentication.
A
With
with
your
help
so
you've
registered
the
app
and
configured
it,
then
you
need
to
host
it
somewhere.
You
could
do
that
on
a
service
like
Heroku,
which
makes
that
part
of
the
service
pretty
simple
and
also
free
and
and
then
you
install
it,
you
can
select
whether
to
do
that
on
all
of
your
accounts,
repos
or
just
specific
ones,
so
here
I'm
select
and
it
just
to
be
installed
on
one
repo
and
going
back
to
this
architecture
if
you're
building
the
app.
How
do
you
even
know
about
installations?
A
A
So
your
app
will
get
sent
an
installation
event
which
would
tell
you
whether
the
installation
was
just
created
or
removed,
and
then
you
could
add
or
remove
data
on
your
side
accordingly
and
the
docks
URL
at
the
bottom.
There
has
an
example
of
what
that
event
would
look
like
and
then
the
fun
part,
so
you
can
connect
that
get
up
github
up
to
whatever
I
put
suits
your
team,
like
maybe
you'd,
connect
it
to
your
slack,
app
or
use
it
to
create
or
change
content
on
github
and
Heroku.
A
You
have
an
open-source
dev
digest
project
that
prepares
content
to
send
via
email
like
that,
isn't
a
github
up
yet,
but
maybe
that's
the
kind
of
thing
that
somebody
here
would
be
interested
in
trying
and
so
for
the
examples
I've
mentioned.
Let's
took
a
look
at
what
you
would
need
to
do
in
the
API,
so
fetching
contributions
for
a
given
user.
A
My
app
could
have
a
method
for
contributions
that
accepts
a
user's
login
and
this
example
is
suited
to
what
the
slack
up
would
need.
So
the
slack
up
would
send
text
like
this.
Whatever
text
was
typed
after
the
command,
so
we
could
parse
the
login
out
of
that,
and
we
could
then
pass
that
user
log
and
receive
deeper
into
the
app
and
create
a
search
for
issues,
say
issues
written
by
that
user,
with
whatever
other
parameters
we
care
about.
A
The
app
would
know
which
kind
this
installation
is
on
because
it
gets
told
that
when
the
installation
is
created
and
which
could
be
the
same
as
this
user
we've
got
past
or
an
organization
that
they're
part
of
here's.
Another
query
that
searches
for
PRS
that
these
are
just
commented
on
and
those
examples
are
using
this
method
search
issues
which
is
from
the
octet
library
here
and
so
I'm,
using
that
just
as
a
client
for
the
github
API,
there
are
a
whole
bunch
of
other
libraries
listed
at
that
URL
I'm,
also
using
Ruby
in
these
examples.
A
But
there
are
wrappers
and
many
other
languages,
so,
whichever
library
you
use
or
if
you
want
to
make
roll
requests
yourself
and
the
developer
Doc's
have
all
the
reference
material
you
need
on
what
like
parameters
are
available
to
the
endpoints
to
help
you
build
up
a
query
that
suits
your
needs,
so
we've
made
our
call
to
search
issues
and
we'd
get
a
response
back
from
the
API
and
the
developer.
Documentation
will
shrink
examples
of
their
kind
of
response.
A
The
app
could
have
a
method
labeled
which
accepts
parameters
for
which
labels
to
search
for
it.
Again,
we
just
pass
those
parameters
into
the
app
and
build
up
a
query
of
what
we
want
to
search
for,
and
it's
really
useful
to
check
your
expected
results
with
the
Advanced
Search
page
in
the
web.
Ui
and
the
API
request
will
use
the
exact
same
query.
Syntax
is
on
the
web
and
then
we
just
make
an
API
request
to
search
issues
using
that
query
that
we
built
up
and
the
slack
app
can
display
those
results
to
the
user.
A
A
So
this
would
be
the
flow
of
events.
Basically,
the
user
would
send
a
command
from
that
slack
up.
The
slack
up
passes
the
request
with,
in
this
case
the
team
name
parameter
to
the
github
op,
the
github
op.
It's
to
just
build
up
the
relevant
query
and
ask
the
API
for
m4
pull
requests
that
match
that
query.
A
A
Your
team
or
company
might
have
a
really
particular
process
to
approve
a
pull
request
that
the
web
UI
just
doesn't
get
her
for,
like.
Maybe
you
need
more
than
two
people
to
have
reviewed
it
or
the
reviewers
can't
also
have
written
the
code,
and
you
could
use
the
API
to
carry
out
those
checks
or
if
your
team
or
company
has
an
example.
A
You
could
fetch
a
list
of
commits
on
a
PR.
The
developer
site
here
will
give
you
an
example
response
of
what
that
would
look
like
a
simplified
example
of
that
response
would
be
JSON
like
this.
So
you
see
you
could
extract
the
authors
from
that
list
of
people
who
committed
on
the
PR.
You
could
then
fetch
a
list
of
reviews
on
the
PR
and
extract
the
names
of
the
users
who
have
given
those
reviews
and
then
do
whatever
special
comparison.
A
Your
teams
to
your
team
wants
to
do
about
those
committers
and
reviewers
and
who
they
are,
and
then
you
could
post
a
status
on
the
PR
to
indicate
if
it
passed
or
failed.
Your
checks
that
status
you
send
via
the
API
will
be
represented
as
a
passing
check
in
the
web
UI
and
if
you've
said
that
review
process
status
is
being
required.
The
PR
would
then
show
that
it's
a
lied
to
be
merged.
A
Maybe
you
work
back
from
whatever
the
problem
is,
then
that
causes
a
pin
like
whether
it's
that
you
want
to
know
what
bugs
have
been
reported
or
what
pull
requests.
Your
team
needs
to
review
or
just
haven't
sort
of
easy
awareness
of.
What's
going
on
with
your
team
and
then
think
about
what
you
want
to
end
up
with.
Is
you
know?
Maybe
it's
something
to
cleanse
quickly
out
from
chat?
A
And
again,
please
do
talk
to
us
and
other
developers
who
are
building
things
with
the
API
and
if
you
have
a
question,
you're
unlikely
to
be
alone,
the
API
is
a
powerful,
very
flexible
tool
and
I
hope.
This
talk
and
other
ones
that
this
conference
helped
it
become
less
intimidating
and
becomes
a
tool
that
you
just
enjoy,
exploring
and
building
on
to
do
whatever
special
crazy
awesome
thing.
It
is
that
you
and
your
team
do
thank
you
and
we'll
be
around
at
the
ask
github
desk
today
tomorrow
and
the
platform
team.