GitHub App vs OAuth app vs fine-grained vs classic personal access token
Verdict: GitHub Apps act as an independent bot with no user sign-in; OAuth apps act on a user's behalf and are the only option for enterprise-object access. Fine-grained PATs scope to one organization and specific repositories; classic PATs are broad.
| Criterion | GitHub App | OAuth app | Fine-grained PAT | Classic PAT |
|---|---|---|---|---|
| Acts as | Independent bot identity, no user sign-in | A specific user's behalf | The user, scoped | The user, broad |
| Scope | Granular per-install permissions | User-authorized scopes | One org/user, specific repos, granular | All repos in the user's orgs |
| Enterprise-object access | Not supported yet | Can be authorized for the enterprise account | Cannot manage enterprise accounts | Not the tool for this |
| Use when | Automation with no user logged in | Enterprise-level resource access | Scoped access to one organization | Legacy broad access |
Rules
- A GitHub App can act independently of any user, suiting automation with no sign-in.
- Fine-grained PATs are limited to one user or organization and can be scoped to specific repositories with granular permissions.
- Enterprise-level object access currently requires an OAuth app; GitHub Apps cannot yet target the enterprise object.
- Classic PATs grant access to all repositories in the organizations the user belongs to.
Traps
- OAuth apps always authorize on a user's behalf and cannot act as an independent bot like a GitHub App.
- A shared classic PAT still authenticates as the individual user, not a bot identity.
- Fine-grained PATs cannot manage enterprise accounts, so they do not solve enterprise-object access.