GitHub OAuth setup

1. Create a GitHub OAuth App

In GitHub, go to:

Settings → Developer settings → OAuth Apps → New OAuth App

Fill in:

• Application name: for example mikan
• Homepage URL: your LINK_URL
• Authorization callback URL: <LINK_URL>/oauth/callback

Example:

LINK_URL=https://mikan.example.com
Callback URL=https://mikan.example.com/oauth/callback

2. Set environment variables

export LINK_URL="https://mikan.example.com"
export GITHUB_OAUTH_CLIENT_ID="<client-id>"
export GITHUB_OAUTH_CLIENT_SECRET="<client-secret>"

If LINK_PORT is not set, mikan listens on 8181 by default when LINK_URL exists.

3. Start mikan

mikan --sandbox=container:mikan-tools /path/to/workspace

Or use a managed per-user container:

mikan --sandbox=image:mikan-sandbox:tools /path/to/workspace

Or:

mikan --sandbox=firecracker:192.168.1.100:/path/to/workspace /path/to/workspace

4. Use /login

In a DM with the bot, type:

/login

Open the link returned by mikan and choose GitHub OAuth.

After success, mikan writes the token into the corresponding vault’s env, including:

GITHUB_OAUTH_ACCESS_TOKEN
GH_TOKEN

Every sandbox mode except host injects these env vars into later tool runs.

These are the credentials of the person who logged in, and they are meant to reach the sandbox — the agent runs gh and git as that person. Note that this is separate from mikan’s own GitHub App identity used by the GitHub adapter, whose tokens stay host-side and never enter a runtime.

Scopes

Default GitHub OAuth scopes:

repo read:user user:email read:org gist

Override them with an environment variable:

export GITHUB_OAUTH_SCOPES="repo read:user user:email read:org gist workflow"

Only add scopes you actually need. Higher-privilege scopes increase risk if credentials leak.