OAuth apps

Managed OAuth#

For GitHub, Coresource's managed OAuth app needs one field:

TypeScript

import { CoreSource } from '@coresourceai/sdk';

const coresource = new CoreSource();

const github = await coresource.mcp.connect({
  name: 'GitHub',
  url: 'https://api.githubcopilot.com/mcp/',
  auth: { type: 'oauth', provider: 'github' }
});

// Send the user here once. Use github.id in `mcpServers` after the callback
// moves the connection to "connected".
console.log(github.authorizationUrl);
console.log(github.status);

An organization can register its own GitHub App or OAuth App instead. The client secret is write-only and encrypted by Coresource.

TypeScript

import { CoreSource } from '@coresourceai/sdk';

const coresource = new CoreSource();

const app = await coresource.mcp.oauthApps.create({
  name: 'Acme GitHub',
  provider: 'github',
  clientId: process.env.GITHUB_CLIENT_ID ?? '',
  clientSecret: process.env.GITHUB_CLIENT_SECRET ?? ''
});

console.log(`Set the GitHub callback URL to ${app.callbackUrl}`);

const github = await coresource.mcp.connect({
  name: 'Acme GitHub',
  url: 'https://api.githubcopilot.com/mcp/',
  auth: { type: 'oauth', appId: app.id }
});

OAuth app profiles are organization-level and require owner access. Rotating an app's credential updates the client used by every connection referencing it, without copying the secret into any run.