{"record":{"id":"b74bcbc410a6a8aa","repo":"coder/code-server","slug":"github-auth-can-only-be-set-in-the-config-file-o","errorCode":null,"errorMessage":"--github-auth can only be set in the config file or passed in via $GITHUB_TOKEN","messagePattern":"--github-auth can only be set in the config file or passed in via \\$GITHUB_TOKEN","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/node/cli.ts","lineNumber":415,"sourceCode":"        if (pair) {\n          key = pair[0] as keyof UserProvidedArgs\n        }\n      }\n\n      if (!key || !options[key]) {\n        throw error(`Unknown option ${arg}`)\n      }\n\n      if (key === \"password\" && !opts?.configFile) {\n        throw new Error(\"--password can only be set in the config file or passed in via $PASSWORD\")\n      }\n\n      if (key === \"hashed-password\" && !opts?.configFile) {\n        throw new Error(\"--hashed-password can only be set in the config file or passed in via $HASHED_PASSWORD\")\n      }\n\n      if (key === \"github-auth\" && !opts?.configFile) {\n        throw new Error(\"--github-auth can only be set in the config file or passed in via $GITHUB_TOKEN\")\n      }\n\n      if (key === \"idle-timeout-seconds\" && Number(value) <= 60) {\n        throw new Error(\"--idle-timeout-seconds must be greater than 60 seconds.\")\n      }\n\n      const option = options[key]\n      if (option.type === \"boolean\") {\n        ;(args[key] as boolean) = true\n        continue\n      }\n\n      // Might already have a value if it was the --long=value format.\n      if (typeof value === \"undefined\") {\n        // A value is only valid if it doesn't look like an option.\n        value = argv[i + 1] && !argv[i + 1].startsWith(\"-\") ? argv[++i] : undefined\n      }\n","sourceCodeStart":397,"sourceCodeEnd":433,"githubUrl":"https://github.com/coder/code-server/blob/51f90a376b42e217b38937410fe2855e0c1db87e/src/node/cli.ts#L397-L433","documentation":"Same secret-rejection guard, applied to `--github-auth` at cli.ts:415. A GitHub OAuth token is a credential and must not appear in argv. Provide it through the config file or the $GITHUB_TOKEN environment variable.","triggerScenarios":"Running `code-server --github-auth=ghp_xxxxx` or passing the token as a CLI flag.","commonSituations":"Enabling GitHub auth for extensions cloning private repos; CI scripts that inject the token as a flag rather than an env var.","solutions":["Set `github-auth:` in the config file","Export `GITHUB_TOKEN` in the environment","If using a token from a secrets broker, write it to the env var at container start rather than the command line"],"exampleFix":"# before\ncode-server --github-auth=ghp_xxxxx\n\n# after\nexport GITHUB_TOKEN=ghp_xxxxx\ncode-server","handlingStrategy":"validation","validationCode":"const SECRET_FLAGS = [\"--password\", \"--hashed-password\", \"--github-auth\"]\nconst leaked = process.argv.filter((a) =>\n  SECRET_FLAGS.some((f) => a === f || a.startsWith(f + \"=\"))\n)\nif (leaked.length) {\n  throw new Error(`Refusing to run: ${leaked.join(\", \")} on the CLI. Use $GITHUB_TOKEN / config file.`)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Inject $GITHUB_TOKEN from your secrets store at deploy time, not the command line","Scope the GitHub token to the minimum required repos/permissions","Rotate tokens regularly and treat them as passwords"],"tags":["security","cli","credentials","secrets","oauth","configuration"],"backgroundTag":null,"analyzedSha":"51f90a376b42e217b38937410fe2855e0c1db87e","analyzedAt":"2026-08-12T11:27:34.273Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}