[Feature Request] Allow GitHub apps to be created privately across multiple orgs in an Enterprise

[jahredhope]

Currently to create a GitHub App across multiple orgs you need to make the GitHub App public or duplicate the App.

For Enterprise Cloud users that have multiple orgs this means exposing internal behaviours (the names and descriptions of GitHub apps) publicly.

Is it on the roadmap to allow GitHub Apps a 3rd visibility option, between Private and Public? One that would allow users make a GitHub App private across an Enterprise, or an explicit list of orgs?

[jorsmatthys]

Hello, we also want this feature at our enterprise.

Currently we have apps that we list as public, so that we can install them on multiple (in our case 8) organizations.
There are other settings at the enterprise level that prevent the public URL of our apps to be visible to people outside of the organization, but this still feels like a hack.
It feels like being able to mark GitHub Apps as "internal" would be a logical addition.

[fblacuttgottret-godaddy]

+1

We need this and I would expect this functionality to be part of the enterprise feature set.

[xino12]

+1

[nuugen]

+1

[HarshitNagar]

There are other settings at the enterprise level that prevent the public URL of our apps to be visible to people outside of the organization

@jorsmatthys what are these settings ? Do they also prevent access to the public URL or just hide it ?

[tyleris-irish]

+1, surprised this isn't a thing. My current plan is to create the same app across 5 orgs under our Enterprise Cloud, but this will be an unnecessary pain because I'm dealing with 5 different private keys.

[lavoiesl]

This seems to be a duplicate of https://github.com/orgs/community/discussions/24549

[jahredhope]

I don't think so.

That issue appears to be about whether you can have an app's tokens access two repositories across organisations at once.

This issue is about the app itself being private or public, i.e. whether public users can see the app. Where currently, you need to make an app public to install it on multiple organisations within an enterprise.

[ina-schaal]

Hi there!
We also need this feature for our enterprise account. Is there a timeline for this?
Best regards!

[equalizer999]

We are currently working on such a feature as mentioned in our Roadmap

[GreyBouton]

I talked to corporate. Leadership says we are going to need this ASAP (in the next 12 hours) so please prioritize this. On behalf of the UN, thank you for your cooperation.

[ChooJosh]

Please have this done as high priority.

[procommand]

I'd like this done as a high priority, this is very crucial to a project being led in Afghanistans embassy and their need for this is essential to their success as a leadership and being able to comply with other nations. Please rush this

[procommand]

@joe-tingsanchali-sonarsource and @jamietanna do we have a problem we need to discuss? Keep your low priority opinion to yourself, clearly you are the least impacted by this and least important in this project.

[queenofcorgis]

@procommand I understand that you are excited and interested in this feature, but with a community of folks from around the world working with GitHub in a unique way folks may respectfully disagree with what needs to be prioritized. But remember to criticize ideas, not people. Be courteous to those you interact with here in the Community. Please be aware that breaking our standards is considered a violation of our Code of Conduct and our moderator team may take appropriate action.

[hpsin]

Hey folks - this is in final testing right now, to make sure it's working securely, with the goal of releasing it before Universe (i.e. in the next week and a half). Specifically this is the ability for an enterprise to own an application and make it available to just their organizations and members. Keep an eye out here and the changelog for details.

[hpsin]

As promised - here we are! Feedback welcome
https://github.blog/changelog/2024-10-22-enterprises-can-create-github-apps-for-use-within-the-enterprise/

[hpsin]

This is now GA, and supports transferring an app to the enterprise from a user or org: https://github.blog/changelog/2025-03-10-enterprise-owned-github-apps-are-now-generally-available/

[jamietanna]

Hey!

Re:

In addition, permission updates made to an enterprise-owned App are now automatically accepted by all of the organizations in the enterprise.

Does that mean an App Manager on an Enterprise-owned App can change permissions and they'll be auto-approved for any Org in the Enterprise, without a Org Owner approving them?

[hpsin]

That's correct. Right now only enterprise owners can manage the enterprise-owned apps, but we're working on adding app managers as well for enterprise-owned apps. The logic is that the enterprise owner can simply add themselves to the org and approve the update. (and clearly wants the permissions to be updated). This has the potential for impact if somehow a developer/admin was reliant on the app not being updated in a specific organization.

We are currently debating whether this auto-update behavior should extend to someone that is trusted to be an app manager (for the enterprise or for a specific app), as it can be used to effectively escalate privilege within every organization where the app is installed. It's likely that this privilege will remain with the enterprise admin as well as a new fine-grained permission like Can update enterprise app permissions and have them automatically accepted, which puts that control back in the hands of the admin who would grant that permission to a user.

[Cavaler]

This still does not allow you to create a cross-organization token, or does it?

[hpsin]

That's correct - this is just ownership.

Installing an app onto the enterprise is currently in testing, which is this item: github/roadmap#1045 - this lets you target just the enterprise account (not the orgs or repos within it) with a GitHub App.

After this item we would look at giving that enterprise installation access to all of the orgs and repos in the enterprise, so you can use one token to leverage the app's permissions everywhere in the enterprise.

[yongzhang]

Hi @hpsin Any progress on the cross-org github token plz? Currently we have to create 2 separete github app client based on the installation id to pull private repos which is very annoying.

[evilhamsterman]

@yongzhang it's been available for almost a year https://docs.github.com/en/enterprise-cloud@latest/admin/managing-github-apps-for-your-enterprise/creating-github-apps-for-your-enterprise

[jamietanna]

I think they're referring to having an App token (or a fine-grained personal access token) that can access multiple orgs at once