By default, new Coder deployments use a Coder-managed GitHub app to authenticateusers.We provide it for convenience, allowing you to experiment with Coderwithout setting up your own GitHub OAuth app.

If you authenticate with it, you grant Coder server read access to your GitHubuser email and other metadata listed during the authentication flow.

This access is necessary for the Coder server to complete the authenticationprocess.To the best of our knowledge, Coder, the company, does not gain accessto this data by administering the GitHub app.

Default Configuration

To use the default configuration:

1. Install the GitHub appin any GitHub organization that you want to use with Coder.

   The default GitHub app requiresdevice flow to authenticate.This is enabled by default when using the default GitHub app.If you disable device flow usingCODER_OAUTH2_GITHUB_DEVICE_FLOW=false, it will be ignored.

2. By default, only the admin user can sign up.To allow additional users to sign up with GitHub, add:

   CODER_OAUTH2_GITHUB_ALLOW_SIGNUPS=true

3. (Optional) If you want to limit sign-ups to specific GitHub organizations, set:

   CODER_OAUTH2_GITHUB_ALLOWED_ORGS="your-org"

Disable the Default GitHub App

You can disable the default GitHub app byconfiguring your own appor by adding the following environment variable to yourCoder server configuration:

Step 1: Configure the OAuth application in GitHub

1. Register a GitHub OAuth app.

2. GitHub will ask you for the following Coder parameters:

   • Homepage URL: Set to your Coder deployment'sCODER_ACCESS_URL (e.g.https://coder.domain.com)

   • User Authorization Callback URL: Set tohttps://coder.domain.com

     If you want to allow multiple Coder deployments hosted on subdomains, such ascoder1.domain.com,coder2.domain.com, to authenticate with thesame GitHub OAuth app, then you can setUser Authorization Callback URL tothehttps://domain.com

3. Take note of the Client ID and Client Secret generated by GitHub.You will use these values in the next step.

4. Coder needs permission to access user email addresses.

   Find theAccount Permissions settings for your app and selectread-only forEmail addresses.

Step 2: Configure Coder with the OAuth credentials

Go to your Coder host and run the following command to start up the Coder server:

Alternatively, if you are running Coder as a system service, you can achieve thesame result as the command above by adding the following environment variablesto the/etc/coder.d/coder.env file:

Once complete, runsudo service coder restart to reboot Coder.

If deploying Coder via Helm, you can set the above environment variables in thevalues.yaml file as such:

To upgrade Coder, run:

We recommend requiring and auditing MFA usage for all users in your GitHub organizations.This can be enforced from the organization settings page in theAuthentication security sidebar tab.

Device Flow

Coder supportsdevice flowfor GitHub OAuth.This is enabled by default for the default GitHub app and cannot be disabled for that app.

For your own custom GitHub OAuth app, you can enable device flow by setting:

Device flow is optional for custom GitHub OAuth apps.We generally recommend using the standard OAuth flow instead, as it is more convenient for end users.