# The decision rule
GitHub's docs are explicit that GitHub Apps are preferred over OAuth apps. Pick by who is acting:
- Software acting on its own (a bot, an integration, an agent fleet): a GitHub App, installed on the repos it needs, with fine-grained permissions.
- A user signing into your app through GitHub: an OAuth app.
- Personal automation for one human: a fine-grained personal access token.
# Why Apps win for integrations
An App gets short-lived installation tokens scoped to exactly the repositories it is installed on, with only the permissions it requested. There is no long-lived user credential to steal, and uninstalling revokes everything at once. An OAuth app or personal token inherits the user's access, which is almost always broader than the integration needs, and it lives until someone revokes it.
# Checks
- If an integration currently runs on a personal access token belonging to an employee, migrate it to a GitHub App. When that employee leaves, the token story gets ugly.
- Review installed Apps and their permissions the way you review team membership. Unused installs get removed.