Security
OAuth authorization
How OSTaaS uses OAuth 2.0 to connect repositories and third-party services on your behalf.
Where OIDC proves who you are at sign-in, OAuth 2.0 grants OSTaaS scoped permission to act against a third-party service — your Git provider, your issue tracker, your payment provider. The two protocols are related but do different jobs.
Authorization code flow
OSTaaS uses the OAuth 2.0 authorization code flow with PKCE for every provider connection:
- You click Connect on a provider (for example GitHub) and are redirected to that provider's consent screen.
- You approve the specific scopes OSTaaS requests.
- The provider redirects back with a short-lived authorization code.
- OSTaaS exchanges that code for an access token server-side — the token never touches your browser.
Scopes we request
OSTaaS requests the narrowest scopes needed for the feature you are enabling. Read access to repository metadata is requested for evidence linking; write access is only requested when you enable a feature that opens pull requests. Each provider's article lists its exact scopes.
Revoking access
You can disconnect a provider at any time from Integrations, and you can additionally revoke the grant from the provider's own security settings. Revocation is effective immediately for new requests; in-flight jobs finish or fail closed.