Connections
GitHub
Camper manages organization teams on GitHub. The happy path is a one-click GitHub App install — operators never paste private keys in the browser.
Prerequisites
- Camper owner or admin
- Permission to install a GitHub App on a GitHub Organization (not a personal account)
- Directory already receiving people (recommended)
- IdP team sync must be off for teams Camper should manage (see Team sync)
Summary of steps
- Connections → GitHub → Set up
- Install the Camper GitHub App on your Organization
- Confirm health on Done, then browse and link teams
Connect (one-click, recommended)
- In Camper: Connections → GitHub → Set up, read Check access, then Continue.
- On Install the app, click Install GitHub App. GitHub opens the install UI — pick a GitHub Organization.
- After install, GitHub redirects back to Camper. Camper seals the installation and runs a health check.
- The dialog opens on Done with the organization name. Browse and link teams under Resources.
If you install on a personal account, Camper reopens the install step with a warning and leaves no failed connection behind — personal accounts cannot host organization teams.
Reinstall or switch org: Manage → Reinstall or switch org.
What the App needs
Typical permissions for team ops:
- Organization members (read)
- Teams (read/write as needed for create and membership)
- Ability to list teams and manage memberships
Exact permissions are defined on Camper’s GitHub App for your environment.
Advanced: bring your own App or token
On Install the app, open Use your own app or a token:
| Mode | Use when |
|---|---|
| Your GitHub App | Enterprise private apps — paste App ID, installation ID, and PEM |
| PAT / token | Local or exceptional cases only |
Prefer the platform install path in production so private key material never hits the browser.
Capabilities
| Capability | Status |
|---|---|
| One-click App install | Supported |
| Connect + health | Supported |
| Browse / import teams | Supported |
| Create / rename / delete teams | Supported |
| Add / remove team members | Supported |
| Map identity email → GitHub login | Supported (SAML/SCIM + verified domain emails) |
Team names are free-form; GitHub slugs are derived (lowercase, hyphens) with collision checks on create/rename.
Archive on GitHub means delete the team (there is no soft-archive). Re-create if you need the team again.
Identity resolution
Camper maps each person's work email to a GitHub login using:
- SAML / SCIM external identities on the org
- Organization-verified domain emails on org members
If neither path finds a user, Camper records drift instead of failing the batch.
Nested teams (optional)
Set a parent team when linking, or enable nesting on the connection with a default parent. Camper passes GitHub’s parent team id on create.
IdP team sync
GitHub team synchronization (Okta, Entra, and other IdPs) makes team membership read-only for apps and admins — GitHub returns “This team’s membership is managed exclusively by …” on add/remove.
Camper’s connection health check probes for team sync (and Enterprise Managed Users external groups). When it is enabled:
- Connect / reinstall fails health and the connection stays in error with a clear reason
- Existing connections re-checked later surface the same status
- Membership tasks that still hit an IdP-managed team fail fatally with the same guidance
What to do: In GitHub org settings, disable team synchronization, or unlink IdP groups from teams Camper should own. Keep IdP → SCIM → Camper as the source of people; let Camper push team membership.
Rate limits
Camper honours GitHub primary and secondary (abuse) rate limits. Secondary limits often arrive as HTTP 403 and are treated as retryable throttles.