[Single sign-on]({{site.baseurl}}/docs/administration/single-sign-on/)

[Configuring access control for GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/)

[Setting up OAuth authentication for Git providers]({{site.baseurl}}/docs/administration/account-user-management/oauth-setup)

{% if page.collection != site.gitops_collection %}

[Setting up OAuth authentication for Git providers]({{site.baseurl}}/docs/administration/account-user-management/oauth-setup)

[Configuring access control for pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control/)

{% endif %}

max-width="70%"

%}

{% if page.collection != site.gitops_collection %}

[Setting up OAuth2 for GitOps]({{site.baseurl}}/docs/administration/account-user-management/oauth-setup/)

{% endif %}

Codefresh integrates with the Git provider defined for the GitOps Runtime to sync repositories to your clusters, implementing Git-based operations when creating resources such as applications, and enriching images with valuable information.

Codefresh integrates withGitHub Cloud asthe Git provider defined for the GitOps Runtime to sync repositories to your clusters, implementing Git-based operations when creating resources such as applications, and enriching images with valuable information.

As the account administrator, you can select the authentication method for the account associated with the Runtime.

Users in the account can then authorize access to the Git provider through the defined mechanism.

Users in the account can then authorize access toGitHub asthe Git provider through the defined mechanism.

{% if page.collection != site.gitops_collection %}

{% include

image.html

lightbox="true"

Codefresh supports OAuth2 or personal access tokens (PATs) for authentication:

***OAuth2 with Codefresh OAuth Application or custom OAuth2 Application**

OAuth2 is the preferred authentication mechanism, supported forpopular Git providers such asGitHub, GitHub Enterprise, GitLab Cloud and Server, and Bitbucket Cloud and Server.

OAuth2 is the preferred authentication mechanism, supported for GitHub.

You have the option to use the default predefined Codefresh OAuth Application, or a custom Oauth2 Application for Codefresh in your Git provider account.

To use a custom Oauth2 Application for Codefresh, first create the application in yourGit provider account, then create a secret on your K8s cluster, and finally configure OAuth2 access for the custom application in Authentication > Settings. <br>

To use a custom Oauth2 Application for Codefresh, first create the application in yourGitHub account, then create a secret on your K8s cluster, and finally configure OAuth2 access for the custom application in Authentication > Settings. <br>

See[Create a custom OAuth2 Application for Git provider](#create-a-custom-oauth2-application-for-git-provider) in this article.

***Token-based authentication using PAT**

With token-based authentication, users must generate personal access tokensfrom theirGit providers with the required scopes and enter their personal access tokens when prompted to authorize access.<br>

With token-based authentication, users must generate personal access tokensfor theirGitHub accounts with the required scopes and enter their personal access tokens when prompted to authorize access.<br>

See[Authorize Git access in Codefresh]({{site.baseurl}}/docs/administration/user-self-management/user-settings/#git-provider-private-access).

{% endif %}

{% if page.collection == site.gitops_collection %}

Codefresh supports OAuth2 or personal access tokens (PATs) for authentication:

***OAuth2 with Codefresh OAuth Application or custom OAuth2 Application**

OAuth2 is the preferred authentication mechanism for GitHub. You have the option to use the default predefined Codefresh OAuth Application, or a custom Oauth2 Application for Codefresh in your Git provider account.

To use a custom Oauth2 Application for Codefresh, first create the application in your Git provider account, then create a secret on your K8s cluster, and finally configure OAuth2 access for the custom application in Authentication > Settings. <br>

See[Create a custom OAuth2 Application for Git provider](#create-a-custom-oauth2-application-for-git-provider) in this article.

***Token-based authentication using PAT**

With token-based authentication, users must generate personal access tokens with the required scopes in their GitHub accounts, and enter their personal access tokens when prompted to authorize access.<br>

See[Authorize Git access in Codefresh]({{site.baseurl}}/docs/administration/user-self-management/user-settings/#git-provider-private-access).

{% endif %}

Create a custom OAuth2 Application for Codefresh in your Git provider account with the correct scopes, and set up authentication for the same within Codefresh. Users can then authorize access to the Git provider using OAuth2, instead of a personal access token.

{% if page.collection != site.gitops_collection %}

Supported Git providers:

* GitHub and GitHub Enterprise

* GitLab Cloud and GitLab Server

* Bitbucket Cloud (hosted) and Bitbucket Data Center (hybrid)

{% endif %}

<br>

Create a custom OAuth2 Application for Codefresh in your GitHub account with the correct scopes, and set up authentication for the same within Codefresh. Users can then authorize access using OAuth2, instead of a personal access token.

To set up OAuth2 authorization in Codefresh, you must:

Create and register an OAuth App under your organization to authorize Codefresh.

1. Follow the step-by-step instructions for your Git provider:

*[GitHub](https://docs.github.com/en/developers/apps/building-oauth-apps/creating-an-oauth-app){:target="\_blank"}:

* For**Authorization callback URL**, enter this value:

where:

`<ingressHost>` is the IP address or URL of the ingress host in the Runtime cluster as defined in your`values.yaml`. <br>For

tunnel-based access modes, run the command`codefresh runtime list` to retrieve the correct host.

* Make sure**Enable Device Flow** is_not_ selected.

* Select**Register application**.

The client ID is automatically generated, and you are prompted to generate the client secret.

* Select**Generate a new client secret**, and copy the generated secret.

{% if page.collection != site.gitops_collection %}

*[GitLab Cloud and Server](https://docs.gitlab.com/ee/integration/oauth_provider.html#user-owned-applications){:target="\_blank"}:

* For**Redirect URI**, enter this value:

where:

`<ingressHost>` is the IP address or URL of the ingress host in the runtime cluster.

*[Bitbucket Data Center](https://confluence.atlassian.com/adminjiraserver0902/configure-an-outgoing-link-1168853925.html){:target="\_blank"}:

* For**Callback URL**, enter this value:

where:

`<ingressHost>` is the IP address or URL of the ingress host in the runtime cluster.

OAuth2 is not supported for hybrid runtimes with Bitbucket Cloud as the Git provider. Users can authorize access with their[Git personal access tokens]({{site.baseurl}}/docs/administration/user-self-management/user-settings/#authorize-git-access-in-codefresh) in such cases.

{% endif %}

{:start="1"}

1. For[GitHub](https://docs.github.com/en/developers/apps/building-oauth-apps/creating-an-oauth-app){:target="\_blank"}, do the following:

* For**Authorization callback URL**, enter this value:

where:

`<ingressHost>` is the IP address or URL of the ingress host in the Runtime cluster as defined in your`values.yaml`. <br>

For tunnel-based access modes, run the command`codefresh runtime list` to retrieve the correct host.

* Make sure**Enable Device Flow** is_not_ selected.

* Select**Register application**.<br>

The client ID is automatically generated, and you are prompted to generate the client secret.

* Select**Generate a new client secret**, and copy the generated secret.

{:start="2"}

1. Note down the following, as you will need them to create the K8s secret for the Git OAuth2 application:

* GitHub: Application ID from the URL, Client ID, and the client secret

* GitLab Cloud and Server: Application ID and Secret

* Bitbucket Data Center: Key and Secret

1. Note down the following, as you will need them to create the K8s secret for the Git OAuth2 application:<br>

* Application ID from the URL, Client ID, and the client secret

<br>

Create a K8s secret in theruntime cluster, using the example below as a guideline. You must define the application ID (`appId`), client ID (`clientId`) and the client secret (`clientSecret`) from the OAuth2 Application you created in yourGit provider, and the Git URL (`url`).

Create a K8s secret in theRuntime cluster, using the example below as a guideline. You must define the application ID (`appId`), client ID (`clientId`) and the client secret (`clientSecret`) from the OAuth2 Application you created in yourGitHub account, and the Git URL (`url`).

All fields in the secret_must be_ encoded in`base64`.

Make sure you have the following handy:

* GitHub: Application ID from the URL, Client ID, and the client secret

{% if page.collection != site.gitops_collection %}

* GitLab Cloud and Server: Application ID and Secret

* Bitbucket Data Center: Key and Secret

{% endif %}

* Application ID from the URL, Client ID, and the client secret

1. Configure the settings for the **Git OAuth2 Application**, either in **Form** or in **YAML** modes:

1. Copy the user access token generated as you will need it to authorize access.

[Git tokens in Codefresh]({{site.baseurl}}/docs/security/git-tokens/)