What i want to do, is to get private repo datas (issues amount) from a small application.
Since I don't want to expose my personal github access_token in the request I searched another solution which I think is OAuth.
So i setted up an OAuth following these and these steps.
And setted the permissions in Auth0 in the social github settings to repo (grants read/write access for repos).
Until now everything works fine, I'm able to authenticate with my github account.
But now I don't know which token I have to use for my request to the github API.
Here is the relevant code I have so far:
const handleAuthentication = () => {
webAuth.parseHash((err, authResult) => {
if (authResult && authResult.accessToken && authResult.idToken) {
window.location.hash = '';
setSession(authResult);
//here the call to the relevant function
getIssues('my-element', /*here i should pass the correct token*/); //tryed all tokens i found in authResult
} else if (err) {
alert(
`Error: ${err.error} . Check the console for further details.`
);
}
});
}
const getIssues = (element, token) => {
const request = new XMLHttpRequest();
request.open('GET', `https://api.github.com/repos/my_organization/element-${element}/issues?access_token=${token}`, true);
request.onload = () => {
if (request.status >= 200 && request.status < 400) {
const data = JSON.parse(request.responseText);
//use the data
} else {
console.log('error');
}
};
request.onerror = function(e) {
console.log('connection error: ', e)
};
request.send();
}
But this results to a 401 (Unauthorized) response.
I didn't use XMLHttpRequests a lot and I'm sure, that I'm missing something fundamental here.
And now i'm not even sure if oAuth is the correct way to achieve what I want.
Any help would be greatly appreciated.
Edit:
Meanwhile I did some more research and found out (here), that there are some steps missing to get the correct user access_token for connecting to the github api.
I'll try to complete these steps and will post an answer if it works.
Would still appreciate a clear answer if somebody knows how to do it exactly.