Any auth flow currently supported for SPA without backend? about octokit.js

[github-actions]

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

[gr2m]

Unfortunately you will need a tiny server component for the OAuth flow. But it's quite simple and you can deploy to for free to e.g. Netlify. Alternatively you can ask a user to create a personal access token and paste it into your app. Username/password authentication for API usage has been disabled for several years now, due to security reasons.

If you want to allow users to limit access to a single repository, I'd register a GitHub app, as installing a GitHub app grants access to user-defined repositories, while OAuth Apps are global. Note that GitHub Apps cannot create a new repository as part of the installation, the user needs to create the repository ahead of time.

[fserb]

I know it's "simple" in the sense that it can be easily deployed. But it's not simple as in it adds a big dependency on the site running. It's a shame there's no solution around that.

It would be nice if there was a friendly flow to request a personal access token and automatically return the token to the site. Meanwhile, I'll stick to copy&pasting it. Thanks.