Why GitHub API don't allow read access for public and private repos? #166582
Replies: 8 comments 6 replies
-
| The app asks for write access because the developer chose broader permissions, even if it's only reading data. Sometimes it's for future features, or just easier for the developer but it's not always necessary. If you don’t trust it, don’t give access. | 
Beta Was this translation helpful? Give feedback.
-
| GitHub API requires explicit permission scopes to ensure security and user control. Even for reading private repos, it needs repo scope, which includes write access, because GitHub doesn’t provide a separate read-only private repo scope. This limitation exists to simplify permission management but can be problematic for apps that only need read access. | 
Beta Was this translation helpful? Give feedback.
-
| GitHub’s permission model sometimes requires apps to request write access even if they only read data because: Read access to private repositories requires broader scopes that are bundled with write permissions for security reasons. Some API operations that seem “read-only” internally use write scopes (e.g., creating temporary tokens, managing webhooks, or caching data). GitHub limits fine-grained permissions to simplify security and avoid fragmented access rights. If an app asks for write access, it’s often because the permissions it needs (especially for private repos) are combined with write scopes in GitHub’s permission system, not because it will necessarily change your data. | 
Beta Was this translation helpful? Give feedback.
-
| You need to give write permission because GitHub groups read and write access together in the same permission scope. Even if the app only reads data, it must request the combined scope, as GitHub doesn't allow more granular control in some cases. | 
Beta Was this translation helpful? Give feedback.
        
          
            
              This comment was marked as off-topic.
            
          
            
        
      
    
            
              This comment was marked as off-topic.
            
          
            
        -
| GitHub’s permission system is sometimes too coarse-grained. To read private repos, the app must request a scope (repo) that also includes write permissions. So it looks like “asking for too much,” but in reality it’s because GitHub doesn’t provide a cleaner option. | 
Beta Was this translation helpful? Give feedback.
-
| GitHub API requires authentication for private repositories and certain actions, even if a repository is public. For public repos, you can read most content anonymously, but some endpoints (like user data, repo stats, or private interactions) always need a token for security and rate-limiting reasons. This ensures that GitHub can track usage, prevent abuse, and protect private data | 
Beta Was this translation helpful? Give feedback.
-
| 🕒 Discussion Activity Reminder 🕒 This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions: 1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as  2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own. 3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution. Note: This dormant notification will only apply to Discussions with the  Thank you for helping bring this Discussion to a resolution! 💬 | 
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Select Topic Area
Question
Body
What is the reason behind the fact that you need to give permission to write to your repository even if the app only read the data and don't write anything.
I just wanted to use an app, but it requires write access, because pro version require read access to private repositories. But still have write access for no reason.
Beta Was this translation helpful? Give feedback.
All reactions