Skip to main content
Connect your GitHub account to let CloudThinker agents read repositories, pull requests, failing checks, and issues — and to run Review on the repositories you select. GitHub authenticates through a GitHub App installation, so you never paste a token into CloudThinker.

​
Prerequisites

  • A GitHub account with access to the repositories you want CloudThinker to reach.
  • Permission to install GitHub Apps — installing to a GitHub organization requires the Organization Owner role.
  • A CloudThinker workspace where GitHub is not already connected.
The GitHub App requests access to the repositories you select, read and write permissions for pull requests, and webhook events for code review.

​
Setup

1

Open CloudThinker

Navigate to Connections → GitHub in your CloudThinker workspace and click Connect.
2

Install the GitHub App

Click Install GitHub App. CloudThinker redirects you to GitHub.
3

Select repositories and authorize

Pick the account or organization, choose all repositories or a subset, and approve the installation.
4

Return to CloudThinker

After you authorize, CloudThinker stores the installation and shows a Connected status.
The GitHub App registers its own webhooks — no manual webhook configuration is needed.

​
Connection details

GitHub uses an app installation — there are no connection fields to enter manually.

​
Required permissions

CloudThinker reaches only the repositories you grant during installation.
  • Read operations cover repositories, pull requests, check and workflow results, and issues.
  • Write operations such as branch changes and pull request updates require explicit approval in CloudThinker.
Follow least privilege: grant the app only the repositories CloudThinker should work with. You can change repository access later in GitHub under the app’s installation settings.

​
Repository access

On top of the GitHub App’s installation scope, the connection carries a CloudThinker-side repository policy. Open the connection’s detail panel and find Repository access under Settings: The policy only ever narrows what the installation already grants, and it is separate from choosing which repositories run Review. Switching from Selected to All and back restores your previous selection.

​
Agent capabilities

Once connected, agents can:

​
Verify the connection

​
Example prompts

​
Write access

Reads run without approval. Any change to a branch or a pull request is approval-gated: CloudThinker states the effect and the exact inputs, then waits for your confirmation before touching the repository.

​
Troubleshooting

You may be signed in to the wrong GitHub account, or the redirect was interrupted. Sign in to the intended account and restart the connection from Connections → GitHub.
Installing CloudThinker to a GitHub organization requires the Organization Owner role. Ask an owner to install the app, or request installation approval through GitHub.
The installation covers only the repositories selected during setup. Open the app’s installation settings on GitHub and extend Repository access to include the missing repository.
A workspace holds one GitHub connection. Use the existing connection, or remove it before connecting a different account or organization.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Scoped installation — the GitHub App reaches only the repositories you grant; widen or narrow access any time from GitHub’s installation settings.
  • Approval for writes — keep branch and pull request changes approval-gated in CloudThinker.

Review Setup

Turn on automated AI code reviews for your GitHub repositories

Provider Authentication

Authentication details for every Review provider