Docs

GitHub Integration Troubleshooting

Fix common GitHub OAuth and integration issues.

#Sign-In vs Integration

Warning. This is the most common confusion. "Continue with GitHub" on the login page is for signing in. Connecting GitHub as an integration (from the Integrations page) is a separate step that grants repository access. You may need to do both.

#"redirect_uri is not associated with this application"

GitHub is rejecting the OAuth callback because the redirect URI doesn't match what's registered in your GitHub OAuth App settings.

#How to fix

1. Check your BACKEND_URL env var. The callback URL is:

{BACKEND_URL}/api/v1/auth/oauth/github/callback

2. Go to github.com → Settings → Developer settings → OAuth Apps

3. Click your OAuth App and update the Authorization callback URL field with the exact URL above.

4. Make sure there's no trailing slash. If your BACKEND_URL is https://api.vergate.dev, the callback URL should be exactly:

https://api.vergate.dev/api/v1/auth/oauth/github/callback
Tip. If you're running locally, you likely need http://localhost:8000/api/v1/auth/oauth/github/callback. Make sure your .env has BACKEND_URL=http://localhost:8000.

#"No access token found"

This error occurs when trying to scan integrations. It means GitHub is connected as a sign-in method but NOT as an integration.

#How to fix

Go to Integrations in your project dashboard and click Connect on the GitHub card. This grants a separate access token with repository permissions.

#Connection shows "Unhealthy" or "Disconnected"

The access token was revoked, expired, or the user removed Vergate's authorization on GitHub.

#How to fix

1. Remove the integration from Vergate (click Remove/Disconnect)
2. Reconnect it from the Integrations page
3. Re-authorize on GitHub when prompted

#Missing repository data in scans

If the security scan can't see certain repositories or data:

• The OAuth token might have limited scopes. Ensure it has read:user, user:email, and repo scopes.
• The repository might be in a different GitHub organization. The token only has access to repos the authorizing user can see.

#GitHub API rate limit exceeded

GitHub's API has rate limits (5000 requests/hour for authenticated users). If you hit the limit:

• Wait for the rate limit to reset (check X-RateLimit-Reset header)
• The security scan will report the current rate limit status
• For CI/CD pipelines, consider using a GitHub App token instead of a PAT