> For the complete documentation index, see [llms.txt](https://docs.teleskope.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.teleskope.ai/connectors/saas/github.md).

# Github

Teleskope scans your GitHub organizations, repositories, and files for secrets and other sensitive data. The connector supports both **GitHub Enterprise Cloud** (github.com) and **GitHub Enterprise Server** (a self-hosted instance at your own base URL), and you can add more than one connection.

{% hint style="info" %}
Teleskope is single-tenant: each customer has a dedicated instance with its own callback and setup URLs, which Teleskope provides.
{% endhint %}

There are two ways to connect. **Automatic** lets Teleskope create and configure the GitHub App for you and is recommended for most customers. **Manual** lets you create the App yourself and hand Teleskope its credentials.

{% tabs %}
{% tab title="Automatic (recommended)" %}
Teleskope creates a least-privilege GitHub App for you from a pre-filled manifest — no app IDs to copy and no private key to handle.

{% stepper %}
{% step %}

#### Start a connection in Teleskope

1. In Observatory, go to **Settings → Clouds → Github** and add a connection.
2. Give the connection a name (no spaces).
3. Choose where it points:
   1. **Enterprise Cloud** — leave the base URL as `https://github.com`.
   2. **Enterprise Server** — enter your GHES base URL (for example, `https://github.your-company.com`).
4. Start the automatic app creation. Teleskope opens GitHub in a new tab with the app already filled in.
   {% endstep %}

{% step %}

#### Create and install the app on GitHub

1. On the GitHub tab, review the pre-filled app and create it. It requests only the least-privilege scanning permissions: **Contents (read)** and **Metadata (read)**.
2. Install the app on the organization(s) you want Teleskope to scan.

{% hint style="info" %}
You must be an organization **admin** to create and install the app on an organization.
{% endhint %}
{% endstep %}

{% step %}

#### Confirm the connection in Teleskope

1. Return to the Observatory tab and choose **Discover organizations** on the connection.
2. Scanning activates automatically once the connection is verified — there is no separate enroll step.
   {% endstep %}
   {% endstepper %}
   {% endtab %}

{% tab title="Manual (bring your own app)" %}
Create the GitHub App yourself and provide its credentials to Teleskope.

{% stepper %}
{% step %}

#### Create a GitHub App

**Requirements**

* **Admin user:** you must be an organization **admin** to create the app and install it on the org.
* **Setup URL:** Teleskope provides your dedicated setup URL.

**Create a new app in GitHub**

1. Go to your Developer settings: `https://<your-github-host>/settings/apps` (use your GHES host for Enterprise Server).
2. Select **GitHub Apps**, then **New GitHub App**.
3. Give your app a unique name and add an optional description.
   1. Avoid using spaces in the app name.
4. Use <https://teleskope.ai> as the homepage URL.
5. Enter your dedicated Teleskope Setup URL:
   1. <https://observatory.{baseURL}/settings/clouds/github?instance\\_name={connectionName}>
6. (Optional) Create a Webhook Secret.
7. Create a private key for the application and download the `.pem` file.

**Grant permissions in GitHub**

**Add the following repository permissions:**

* Contents (read, mandatory)
* Metadata (read-only, mandatory)
  {% endstep %}

{% step %}

#### Enroll the connection in Teleskope

1. On <https://observatory.{baseURL}/settings/clouds/github>, add a connection.
2. Enter your app's:
   1. Connection Name (must match the `instance_name` in the Setup URL above)
   2. Base URL — `https://github.com` for Enterprise Cloud, or your GHES base URL for Enterprise Server
   3. App name
   4. App ID
   5. Github App Private Key — upload the `.pem` file directly (the field is masked; use show/hide to check it)
3. Submit the connection, then follow the prompt to install the app on GitHub and return to Observatory.
4. Choose **Discover organizations** on the connection. Scanning activates automatically once the connection is verified.
5. Delete your local Private Key .pem file.
   {% endstep %}
   {% endstepper %}
   {% endtab %}
   {% endtabs %}