Fine-grained PATs

[samhh]

Hi again 😄

I've joined a GitHub org that has restrictions around classic PATs for security reasons. Would it be possible to support fine-grained PATs instead?

[jasonlong]

Hey @samhh, unfortunately this isn't something I can fix on the Octodot side. Everything relies on GitHub's notifications REST API and those endpoints don't accept fine-grained PATs. The REST docs for notifications says:

These endpoints only support authentication using a personal access token (classic).

AFAIK there's no GraphQL fallback either. Notifications aren't exposed in the GraphQL schema.

The only path I can see that would work for an org with classic PATs disabled is migrating Octodot's auth to a GitHub App with user-to-server OAuth. That's a much bigger change — OAuth device flow, app registration, refresh-token handling — and I'd want to spike it first to confirm user-to-server tokens actually work against the notifications endpoints. If a few more people hit this wall I'll seriously look at it. For now I'll leave this issue open as the tracker.

Sorry I don't have better news. 🙇