Extendable client for GitHub's REST & GraphQL APIs
Installations
npm install @octokit/core
Developer Guide
Typescript
Yes
Module System
ESM
Min. Node Version
>= 18
Node Version
22.12.0
NPM Version
10.8.1
Score
97.8
Supply Chain
99.5
Quality
89
Maintenance
100
Vulnerability
100
License
Releases
Contributors
Languages
TypeScript (96.34%)
JavaScript (3.66%)
Developer
octokit
Download Statistics
Total Downloads
1,149,451,124
Last Day
1,837,288
Last Week
8,380,842
Last Month
37,017,833
Last Year
426,210,312
GitHub Statistics
1,203 Stars
624 Commits
312 Forks
101 Watching
14 Branches
28 Contributors
Package Meta Information
Latest Version
6.1.3
Package Id
@octokit/core@6.1.3
Unpacked Size
22.31 kB
Size
7.61 kB
File Count
8
NPM Version
10.8.1
Node Version
22.12.0
Publised On
03 Jan 2025
Total Downloads
Cumulative downloads
Total Downloads
1,149,451,124
Last day
-4.2%
1,837,288
Compared to previous day
Last week
-12.5%
8,380,842
Compared to previous week
Last month
5.7%
37,017,833
Compared to previous month
Last year
32.2%
426,210,312
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
7
Dev Dependencies
19
core.js
Extendable client for GitHub's REST & GraphQL APIs
- Usage
- Options
- Defaults
- Authentication
- Logging
- Hooks
- Plugins
- Build your own Octokit with Plugins and Defaults
- LICENSE
If you need a minimalistic library to utilize GitHub's REST API and GraphQL API which you can extend with plugins as needed, then @octokit/core
is a great starting point.
If you don't need the Plugin API then using @octokit/request
or @octokit/graphql
directly is a good alternative.
Usage
Browsers |
Load @octokit/core directly from esm.sh
|
---|---|
Node |
Install with
|
As we use conditional exports, you will need to adapt your tsconfig.json
. See the TypeScript docs on package.json "exports".
REST API example
1// Create a personal access token at https://github.com/settings/tokens/new?scopes=repo
2const octokit = new Octokit({ auth: `personal-access-token123` });
3
4const response = await octokit.request("GET /orgs/{org}/repos", {
5 org: "octokit",
6 type: "private",
7});
See @octokit/request
for full documentation of the .request
method.
GraphQL example
1const octokit = new Octokit({ auth: `secret123` }); 2 3const response = await octokit.graphql( 4 `query ($login: String!) { 5 organization(login: $login) { 6 repositories(privacy: PRIVATE) { 7 totalCount 8 } 9 } 10 }`, 11 { login: "octokit" }, 12);
See @octokit/graphql
for full documentation of the .graphql
method.
Options
name | type | description |
---|---|---|
options.authStrategy
|
Function |
Defaults to @octokit/auth-token . See Authentication below for examples.
|
options.auth
|
String or Object
| See Authentication below for examples. |
options.baseUrl
|
String
|
When using with GitHub Enterprise Server, set
|
options.previews
|
Array of Strings
|
Some REST API endpoints require preview headers to be set, or enable additional features. Preview headers can be set on a per-request basis, e.g.
You can also set previews globally, by setting the
|
options.request
|
Object
|
Set a default request timeout ( There are more |
options.timeZone
|
String
|
Sets the
The time zone header will determine the timezone used for generating the timestamp when creating commits. See GitHub's Timezones documentation. |
options.userAgent
|
String
|
A custom user agent string for your app or library. Example
|
Defaults
You can create a new Octokit class with customized default options.
1const MyOctokit = Octokit.defaults({ 2 auth: "personal-access-token123", 3 baseUrl: "https://github.acme-inc.com/api/v3", 4 userAgent: "my-app/v1.2.3", 5}); 6const octokit1 = new MyOctokit(); 7const octokit2 = new MyOctokit();
If you pass additional options to your new constructor, the options will be merged shallowly.
1const MyOctokit = Octokit.defaults({ 2 foo: { 3 opt1: 1, 4 }, 5}); 6const octokit = new MyOctokit({ 7 foo: { 8 opt2: 1, 9 }, 10}); 11// options will be { foo: { opt2: 1 }}
If you need a deep or conditional merge, you can pass a function instead.
1const MyOctokit = Octokit.defaults((options) => { 2 return { 3 foo: Object.assign({}, options.foo, { opt1: 1 }), 4 }; 5}); 6const octokit = new MyOctokit({ 7 foo: { opt2: 1 }, 8}); 9// options will be { foo: { opt1: 1, opt2: 1 }}
Be careful about mutating the options
object in the Octokit.defaults
callback, as it can have unforeseen consequences.
Authentication
Authentication is optional for some REST API endpoints accessing public data, but is required for GraphQL queries. Using authentication also increases your API rate limit.
By default, Octokit authenticates using the token authentication strategy. Pass in a token using options.auth
. It can be a personal access token, an OAuth token, an installation access token or a JSON Web Token for GitHub App authentication. The Authorization
header will be set according to the type of token.
1import { Octokit } from "@octokit/core"; 2 3const octokit = new Octokit({ 4 auth: "mypersonalaccesstoken123", 5}); 6 7const { data } = await octokit.request("/user");
To use a different authentication strategy, set options.authStrategy
. A list of authentication strategies is available at octokit/authentication-strategies.js.
Example
1import { Octokit } from "@octokit/core"; 2import { createAppAuth } from "@octokit/auth-app"; 3 4const appOctokit = new Octokit({ 5 authStrategy: createAppAuth, 6 auth: { 7 appId: 123, 8 privateKey: process.env.PRIVATE_KEY, 9 }, 10}); 11 12const { data } = await appOctokit.request("/app");
The .auth()
method returned by the current authentication strategy can be accessed at octokit.auth()
. Example
1const { token } = await appOctokit.auth({ 2 type: "installation", 3 installationId: 123, 4});
Logging
There are four built-in log methods
octokit.log.debug(message[, additionalInfo])
octokit.log.info(message[, additionalInfo])
octokit.log.warn(message[, additionalInfo])
octokit.log.error(message[, additionalInfo])
They can be configured using the log
client option. By default, octokit.log.debug()
and octokit.log.info()
are no-ops, while the other two call console.warn()
and console.error()
respectively.
This is useful if you build reusable plugins.
If you would like to make the log level configurable using an environment variable or external option, we recommend the console-log-level package. Example
1import consoleLogLevel from "console-log-level"; 2const octokit = new Octokit({ 3 log: consoleLogLevel({ level: "info" }), 4});
Hooks
You can customize Octokit's request lifecycle with hooks.
1octokit.hook.before("request", async (options) => { 2 validate(options); 3}); 4octokit.hook.after("request", async (response, options) => { 5 console.log(`${options.method} ${options.url}: ${response.status}`); 6}); 7octokit.hook.error("request", async (error, options) => { 8 if (error.status === 304) { 9 return findInCache(error.response.headers.etag); 10 } 11 12 throw error; 13}); 14octokit.hook.wrap("request", async (request, options) => { 15 // add logic before, after, catch errors or replace the request altogether 16 return request(options); 17});
See before-after-hook for more documentation on hooks.
Plugins
Octokit’s functionality can be extended using plugins. The Octokit.plugin()
method accepts a plugin (or many) and returns a new constructor.
A plugin is a function which gets two arguments:
- the current instance
- the options passed to the constructor.
In order to extend octokit
's API, the plugin must return an object with the new methods. Please refrain from adding methods directly to the octokit
instance, especialy if you depend on keys that do not exist in @octokit/core
, such as octokit.rest
.
1// index.js 2import { Octokit } from "@octokit/core"; 3import myPlugin from "./lib/my-plugin.js"; 4import octokitPluginExample from "octokit-plugin-example"; 5const MyOctokit = Octokit.plugin( 6 myPlugin, 7 octokitPluginExample 8); 9 10const octokit = new MyOctokit({ greeting: "Moin moin" }); 11octokit.helloWorld(); // logs "Moin moin, world!" 12octokit.request("GET /"); // logs "GET / - 200 in 123ms" 13 14// lib/my-plugin.js 15const plugin = (octokit, options = { greeting: "Hello" }) => { 16 // hook into the request lifecycle 17 octokit.hook.wrap("request", async (request, options) => { 18 const time = Date.now(); 19 const response = await request(options); 20 console.log( 21 `${options.method} ${options.url} – ${response.status} in ${Date.now() - 22 time}ms` 23 ); 24 return response; 25 }); 26 27 // add a custom method 28 return { 29 helloWorld: () => console.log(`${options.greeting}, world!`); 30 } 31}; 32export default plugin;
Build your own Octokit with Plugins and Defaults
You can build your own Octokit class with preset default options and plugins. In fact, this is mostly how the @octokit/<context>
modules work, such as @octokit/action
:
1import { Octokit } from "@octokit/core"; 2import { paginateRest } from "@octokit/plugin-paginate-rest"; 3import { throttling } from "@octokit/plugin-throttling"; 4import { retry } from "@octokit/plugin-retry"; 5import { createActionAuth } from "@octokit/auth-action"; 6const MyActionOctokit = Octokit.plugin( 7 paginateRest, 8 throttling, 9 retry, 10).defaults({ 11 throttle: { 12 onAbuseLimit: (retryAfter, options) => { 13 /* ... */ 14 }, 15 onRateLimit: (retryAfter, options) => { 16 /* ... */ 17 }, 18 }, 19 authStrategy: createActionAuth, 20 userAgent: `my-octokit-action/v1.2.3`, 21}); 22 23const octokit = new MyActionOctokit(); 24const installations = await octokit.paginate("GET /app/installations");
LICENSE
No vulnerabilities found.
Reason
all changesets reviewed
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
packaging workflow detected
Details
- Info: Project packages its releases by way of GitHub Actions.: .github/workflows/release.yml:18
Reason
SAST tool is run on all commits
Details
- Info: SAST configuration detected: CodeQL
- Info: all commits (30) are checked with a SAST tool
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Info: Found linked content: SECURITY.md:1
- Warn: One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy
- Info: Found text in security policy: SECURITY.md:1
Reason
1 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
Reason
10 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 8
Reason
dependency not pinned by hash detected -- score normalized to 5
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/add_to_octokit_project.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/octokit/core.js/add_to_octokit_project.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/octokit/core.js/codeql.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/octokit/core.js/codeql.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:58: update your workflow using https://app.stepsecurity.io/secureworkflow/octokit/core.js/codeql.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:71: update your workflow using https://app.stepsecurity.io/secureworkflow/octokit/core.js/codeql.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/immediate-response.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/octokit/core.js/immediate-response.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/octokit/core.js/release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/octokit/core.js/release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/octokit/core.js/test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/octokit/core.js/test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/octokit/core.js/test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-prettier.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/octokit/core.js/update-prettier.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-prettier.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/octokit/core.js/update-prettier.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/update-prettier.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/octokit/core.js/update-prettier.yml/main?enable=pin
- Info: 0 out of 12 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 2 third-party GitHubAction dependencies pinned
- Info: 4 out of 4 npmCommand dependencies pinned
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:29
- Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql.yml:28
- Warn: no topLevel permission defined: .github/workflows/add_to_octokit_project.yml:1
- Warn: no topLevel permission defined: .github/workflows/codeql.yml:1
- Warn: topLevel 'contents' permission set to 'write': .github/workflows/release.yml:12
- Warn: no topLevel permission defined: .github/workflows/test.yml:1
- Warn: no topLevel permission defined: .github/workflows/update-prettier.yml:1
- Info: no jobLevel write permissions found
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Score
7.4
/10
Last Scanned on 2025-01-27
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More