# octokit-auth-probot > Octokit authentication strategy that supports token, app (JWT), and event-based installation authentication Latest version **4.2.2** (published 2025-11-13) · ISC license · 0 weekly downloads ## Install ```sh npm install octokit-auth-probot pnpm add octokit-auth-probot yarn add octokit-auth-probot bun add octokit-auth-probot ``` ## Health **Score 65/100 (B)** — status: stable. Positive: has types; esm support; no vulnerabilities; has provenance; high maintenance score. Warnings: low downloads. ## Facts | | | |---|---| | Version | 4.2.2 | | Published | 2025-11-13 | | First published | 2020-10-28 | | Weekly downloads | 0 | | License | ISC | | TypeScript types | bundled | | Module format | ESM + CommonJS | | Node | ^20.17 \|\| >=22 | | Dependencies | 4 | | Unpacked size | 29.2 KB | | Known vulnerabilities | 0 | | Install scripts | no | | Provenance | attested (GitHub Actions) | | GitHub stars | 15 | | Author | Gregor Martynus | | Maintainers | probotbot | | Keywords | octokit-authentication-strategy | ## Links - npm: https://www.npmjs.com/package/octokit-auth-probot - Repository: https://github.com/probot/octokit-auth-probot - Homepage: https://github.com/probot/octokit-auth-probot#readme - Issues: https://github.com/probot/octokit-auth-probot/issues - npm.io page: https://npm.io/package/octokit-auth-probot ## Dependencies (4) - [@octokit/types](https://npm.io/package/@octokit/types.md) ^16.0.0 - [@octokit/auth-app](https://npm.io/package/@octokit/auth-app.md) ^8.1.2 - [@octokit/auth-token](https://npm.io/package/@octokit/auth-token.md) ^6.0.0 - [@octokit/auth-unauthenticated](https://npm.io/package/@octokit/auth-unauthenticated.md) ^7.0.3 ## Alternatives - [@clerk/clerk-expo](https://npm.io/package/@clerk/clerk-expo.md) — 133.6K weekly downloads - [@pothos/plugin-authz](https://npm.io/package/@pothos/plugin-authz.md) — 12.4K weekly downloads - [@bounded-sh/client](https://npm.io/package/@bounded-sh/client.md) — 3.2K weekly downloads - [@luigi-project/plugin-auth-oauth2](https://npm.io/package/@luigi-project/plugin-auth-oauth2.md) — 2.3K weekly downloads - [@nocobase/plugin-verification](https://npm.io/package/@nocobase/plugin-verification.md) — 2.0K weekly downloads ## Recent versions - 4.2.2 (latest) — 2025-11-13 - 2.0.2 (release-2.x) — 2025-07-11 - 3.1.2 (release-3.x) — 2025-07-11 - 3.1.0-beta.3 (beta) — 2025-03-01 - 4.2.1 — 2025-10-04 - 4.2.0 — 2025-08-27 - 4.1.0 — 2025-08-27 - 4.0.1 — 2025-07-10 - 4.0.0 — 2025-05-20 - 3.1.1 — 2025-04-10 - 3.1.0 — 2025-03-01 - 3.1.0-beta.2 — 2025-03-01 - 3.1.0-beta.1 — 2025-02-28 - 3.0.2 — 2024-11-16 - 2.0.1 — 2024-11-05 - … 16 more at https://npm.io/package/octokit-auth-probot/versions ## README # octokit-auth-probot > Octokit authentication strategy that supports token, app (JWT), and event-based installation authentication [![@latest](https://img.shields.io/npm/v/octokit-auth-probot.svg)](https://www.npmjs.com/package/octokit-auth-probot) [![Build Status](https://github.com/probot/octokit-auth-probot/workflows/Test/badge.svg)](https://github.com/probot/octokit-auth-probot/actions?query=workflow%3ATest) `octokit-auth-probot` combines the authentication strategies: 1. [`@octokit/auth-app`](https://github.com/octokit/auth-app.js#readme) 2. [`@octokit/auth-token`](https://github.com/octokit/auth-token.js#readme) 3. [`@octokit/auth-unauthenticated`](https://github.com/octokit/auth-unauthenticated.js#readme) It adds a new authentication type: `"event-octokit"`, which allows to retrieve an Octokit instance which is correctly authenticated based on the Octokit constructors authentication (`app` or `token`) as well as the event, which either results in an installation access token authentication or, in case the event implies that the installation's access has been revoked, in an unauthenticated Octokit instance. `octokit-auth-probot` is not meant to be used by itself, but in conjuction with [`@octokit/core`](https://github.com/octokit/core.js#readme) or a compatible library. ## Usage
Browsers Load `octokit-auth-probot` directly from [esm.sh](https://esm.sh) ```html ```
Node Install with npm install octokit-auth-probot ```js const { Octokit } = require("@octokit/core"); const { createProbotAuth } = require("octokit-auth-probot"); // or: // import { Octokit } from "@octokit/core"; // import { createProbotAuth } from "octokit-auth-probot"; ```
⚠️ For usage in browsers: The private keys provided by GitHub are in `PKCS#1` format, but the WebCrypto API only supports `PKCS#8`. You need to convert it first: ```shell openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in private-key.pem -out private-key-pkcs8.key ``` No conversion is needed in Node, both `PKCS#1` and `PKCS#8` format will work.
```js const { Octokit } = require("@octokit/core"); const { createProbotAuth } = require("octokit-auth-probot"); const ProbotOctokit = Octokit.defaults({ authStrategy: createProbotAuth, }); ``` ### Token authentication ```js const octokit = new ProbotOctokit({ auth: { token: "secret 123", }, }); ``` **Note**: when using `octokit.auth({ type: "installation", factory })`, `factory(options)` will be called with `options.octokit`, `options.octokitOptions`, plus any other properties that have been passed to `octokit.auth()` besides `type` and `factory`. In all other cases, `octokit.auth()` will resolve with an [`oauth` authentication object](https://github.com/octokit/auth-token.js#authentication-object), no matter the passed options. ### App authentication ```js const octokit = new ProbotOctokit({ auth: { appId: 123, privateKey: `----BEGIN RSA PRIVATE KEY----- ...`, }, }); ``` ### Unauthenticated ```js const octokit = new ProbotOctokit(); ``` This is useful if you need to send a request without access to authentication. Probot's use case here is [Create a GitHub App from a manifest](https://docs.github.com/en/free-pro-team@latest/rest/reference/apps#create-a-github-app-from-a-manifest) (`POST /app-manifests/{code}/conversions`), which is used to register a GitHub app and retrieve the credentials in return. ### Get authenticated octokit instance based on event ```js const eventOctokit = await octokit.auth({ type: "event-octokit", event: { name: "push", payload: { installation: { id: 123 } } }, // event payload }); ``` `eventOctokit` is now authenticated in one of three ways: 1. If `octokit` was authenticated using a token, `eventOctokit` is authenticated with the same token. In fact, `eventOctokit` _is_ `octokit` 2. If `event` name is `installation` and `payload.action` is either `suspend` or `deleted`, then `eventOctokit` is unauthenticated using [`@octokit/auth-unauthenticated`](https://github.com/octokit/auth-unauthenticated.js#readme) 3. Otherwise `eventOctokit` is authenticated as installation based on `payload.installation.id` ## LICENSE [ISC](LICENSE) --- _Source: https://npm.io/package/octokit-auth-probot · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._