RealComposer
START FREE
Upstream APIsOfficial GitHub docs

GitHub Safe & Unsafe Practices

Direct Answer

GitHub personal access tokens, OAuth tokens, and GitHub App private keys are server-only. Prefer fine-grained tokens or GitHub Apps scoped to specific repositories, and cache responses because unauthenticated requests are limited to 60 per hour.

Credentials & Where They Belong

Server only
Fine-grained personal access token

Scoped to selected repositories and permissions.

Server only
Classic personal access token

Broad scopes such as repo grant access to every repository.

Server only
GitHub App private key

Mints installation tokens for the app.

Safe Practices

  • Use fine-grained tokens or GitHub Apps

    Limit access to the repositories and permissions each integration needs.

  • Cache with ETags

    Conditional requests that return 304 do not count against your rate limit.

  • Verify webhook signatures

    Check X-Hub-Signature-256 with your webhook secret before handling events.

Unsafe Practices

  • Shipping a classic repo-scoped token to a client

    It can read and push to every private repository the user owns.

  • Committing tokens to source control

    Secret scanning will revoke many leaked tokens, but attackers often find them first.

The RealComposer Pattern

Store GITHUB_TOKEN in the vault, cache repository and release reads at the edge, and slim large payloads into compact stats objects.

START BUILDING FREE

Frequently Asked Questions

Q:Why do I hit GitHub rate limits from the browser?

Unauthenticated requests share a 60 per hour limit per IP. Authenticated, cached server calls get far higher limits.

GitHub Recipes

All GitHub recipes (7)
Frontend / WebGitHub
Security & Secret Vault

Call Github API with Private Personal Access Token from Client

To solve call github api with private personal access token from client, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe
Frontend / WebGitHub
Edge Caching & Rate Limits

How to Cache Github API Rate Limit 60 Requests Per Hour

To solve how to cache github api rate limit 60 requests per hour, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe
Frontend / WebGitHub
Multi-API Aggregation

How to Merge Github Profile and Repos into One API Call

To solve how to merge github profile and repos into one api call, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe
Frontend / WebLinearGitHub
Multi-API Aggregation

Merge Linear Issues and Github Pull Requests into One Dashboard API

To solve merge linear issues and github pull requests into one dashboard api, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe
Mobile App (iOS & Android)GitHub
Payload Slimmer

Github API Response Payload Slimming for Mobile Widgets

To solve github api response payload slimming for mobile widgets, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe

Related Concepts

API Rate Limiting

API Rate Limiting is a traffic control mechanism that caps the number of requests a client, IP address, or API token can execute within a specified time window. Rate limiting prevents server overloading, protects against credential brute-forcing, and shields upstream APIs from exceeding subscription quotas.

ETag (Entity Tag)

An ETag, or entity tag, is an HTTP response header containing a version identifier for a resource. Clients send it back in an If-None-Match header, and if the resource has not changed, the server replies with 304 Not Modified and no body, saving bandwidth.

Secret Rotation

Secret rotation is the practice of periodically replacing API keys, passwords, and other credentials with new values and revoking the old ones. Rotation limits how long a leaked secret remains useful and is required by many security standards.