What is the difference between OAuth Apps and GitHub Apps when accessing GitHub resources?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the key: OAuth Apps wear the user's badge — every action they take looks like the user did it. GitHub Apps have their own employee badge — they show up as 'MyApp[bot]' and only touch what you've specifically given them access to.
Full explanation below image
Full Explanation
This is a critical architectural distinction: GitHub Apps have their own identity and act as themselves using installation access tokens. When a GitHub App performs an action, it shows as 'app-name[bot]' in the audit log. GitHub Apps can be installed at the repository level with fine-grained permissions, making them more secure. OAuth Apps impersonate the authorizing user — they act 'on behalf of' that user and have the same permissions that user has across all their accessible resources. OAuth Apps cannot be scoped to specific repositories. GitHub Apps are generally preferred for automations and integrations because of their granular permissions and independent identity.