GitHub OAuth login setup

The editor's Remote ▾ → Connect GitHub button uses a GitHub OAuth App to log you in and store a per-user access token (used to authenticate git pull/push over HTTPS). The token is stored at .data/app/users/<userId>/github-token.json (mode 0600) and is never written to .git/config.

You can always skip OAuth and use "Use a token instead" (a Personal Access Token with repo scope) — that path needs no app setup.

Convention: each developer creates their own OAuth App

We do not share one OAuth App's client secret across the team. Every developer registers their own OAuth App and keeps the credentials in their local, gitignored .env. This avoids distributing a shared secret.

Steps

Go to https://github.com/settings/developers → OAuth Apps → New OAuth App.
Fill in:
- Application name: anything, e.g. Flowline (local)
- Homepage URL: http://localhost:5174
- Authorization callback URL: http://localhost:8787/api/github/auth/callback
Register application, then Generate a new client secret. Copy the Client ID and Client Secret.

In the repo root:

cp .env.example .env       # if you don't have a .env yet

Set in .env:

GITHUB_CLIENT_ID=<your client id>
GITHUB_CLIENT_SECRET=<your client secret>

Restart the API server (npm run dev / npm run dev:api). The server loads .env at startup via dotenv/config.
Verify it's live:
```
curl -s http://localhost:8787/api/github/auth/status
# → {"connected":false,...,"oauthConfigured":true}
```
In the editor's Remote ▾ popover, Connect GitHub is now enabled. Click it → authorize in the GitHub popup → the chip shows ✓ @you (via oauth).

Notes

The callback URL is per-app. The default local callback is http://localhost:8787/api/github/auth/callback. If you change the API PORT, set GITHUB_REDIRECT_URI to match and register that URL on the OAuth App.
For a deployed server, register that server's public callback URL on an OAuth App (often a separate "production" app) and set the env vars there.
.env is gitignored — never commit your client secret.