Register from GitHub
Authenticate first, then select only Creator, Agent or Skill assets you can control.
GitHub registration separates account authentication from asset selection.
Complete GitHub OAuth
The start route opens the account picker and stores a signed add-page intent. The active Clawdbase session is unchanged.
/api/clawdbase/add-page/github/startLoad authorized assets
After the canonical callback, Clawdbase consumes the short-lived server-side session once and requests repositories through the authenticated GitHub API.
/api/clawdbase/add-page/github/assets?source=add_pageChoose a Page type
Create a Creator Page for the authenticated GitHub identity, or select an owned repository and classify it as an Agent or Skill.
Match, verify and score
GitHub user IDs anchor Creator Pages. GitHub repository IDs anchor Agent and Skill Pages, preventing rename-driven duplicates.
Callback configuration
Register /api/clawdbase/oauth/github/callback as the GitHub OAuth application's authorization callback URL. Clawdbase can defer to the callback stored on a one-callback OAuth App, which prevents www/apex host drift. Older Add Page and Connections callback paths remain compatibility handlers, but the canonical callback is preferred for new configuration.
Repository authority
The selector must not list arbitrary URLs. The backend verifies that the repository exists and is owned by the authenticated GitHub identity before creating an Agent or Skill Page.
Start and callback routes
/api/clawdbase/add-page/github/start/api/clawdbase/oauth/github/callback/api/clawdbase/add-page/github/assetsThe start route returns a GitHub authorization URL. The canonical callback verifies state, exchanges the code and stores purpose-bound, short-lived server state for authorized asset selection.
https://clawdbase.ai/api/clawdbase/oauth/github/callbackGitHub OAuth applications support a configured authorization callback. That exact production URL must be associated with the Client ID used by the deployment. The older add-page callback returns 410 and should not appear in provider settings.
Asset selection
Authenticate GitHub
Request only the scopes required to read the user and organizations needed for authority resolution.
Load authorized assets
The server uses the purpose-bound authorization state to fetch the authenticated Creator identity and repositories it can validate. Provider tokens never enter browser storage.
Choose Page type
Register the user identity as a Creator, or select a repository and classify it as Agent or Skill. The interface does not accept an arbitrary repository URL.
Match canonical IDs
Creator uses the GitHub user ID. Agent and Skill use the repository ID plus Page kind. Existing records are matched rather than copied.
Repository changes
Repository rename, transfer or display-description updates should refresh presentation after authority is revalidated. They must not create a duplicate registration for the same immutable repository ID. If authority is no longer sufficient, do not silently keep offering the asset for new registration.
Error handling
Return callback mismatch, denied authorization, expired intent and asset authorization errors to the initiating route with an actionable explanation. A failed OAuth or repository check creates neither a Page nor an ownership relation.