GitHub
Our GitHub integration collects metadata about your organization’s activity across repositories, pull requests, and deployments. We never read, transmit, or store source code. Sensitive data, such as branch names and pull request titles, are always encrypted.
Permissions
We request only the necessary permissions to analyze Git metadata. Below is a description of the scopes requested when connecting to GitHub:
- Repository: Read access to actions, checks, code, commit statuses, deployments, issues, metadata, and pull requests
- Organization: Read access to members, organization administration, organization copilot seat management, and organization projects
- User: Read access to email addresses, public repositories, public organization information, and public user profile data
We require read access to metadata for commits, branches, and releases. Since GitHub’s API does not offer more granular permissions for these specific endpoints, we must request read access to all repository contents. Please note that we never read, transmit, or store source code.
You can learn more about permissions for GitHub Apps in GitHub’s documentation .
Requesting App Access
Creating an Antenna organization requires a GitHub organization. By default, OAuth app access restrictions are enabled for GitHub organizations:
When OAuth app access restrictions are enabled, organization members and outside collaborators cannot authorize OAuth app access to organization resources. Organization members can request owner approval for OAuth apps they’d like to use, and organization owners receive a notification of pending requests.
If you do not see your GitHub organization when trying to create an Antenna organization, you will need to request that an organization admin approves the Antenna application for use in your organization.
You can request access from your GitHub account , or follow GitHub’s guide on how to request OAuth app access . An organization admin will then need to approve the request .
IP Allowlisting
If your organization restricts access by IP address, you must allow traffic from Antenna before connecting your Git provider. All of our API requests come from a fixed set of load balancer IP addresses, so an active allowlist that does not include them will block both sign-in and data imports.
Add all five addresses below. In tools that require CIDR notation, append /32 to each address (for example, 100.21.131.68/32).
| IP address | Direction |
|---|---|
100.21.131.68 | Inbound and outbound |
54.200.57.76 | Inbound and outbound |
52.37.32.106 | Inbound and outbound |
44.241.124.75 | Inbound and outbound |
54.69.112.12 | Egress (outbound requests from Antenna) |
When an address is missing from your allowlist, the connection often looks successful while requests fail in the background with 403 errors and no data appears in your reports. If you are unsure whether an IP restriction is active, ask your provider administrator to confirm before connecting, or contact us at support@antenna.dev.
GitHub Enterprise Cloud
IP allow lists are only available on GitHub Enterprise Cloud, where they are commonly enabled. If your organization or enterprise has one, add Antenna’s IP addresses before you connect. Otherwise, even signing up fails, because GitHub rejects the initial user lookup with a 403 response stating that the enterprise has an IP allow list enabled.
Allow lists can be configured at both the organization and the enterprise level, and each one is enforced independently. If your enterprise owns the allow list, an organization owner cannot fix it on their own — an enterprise owner must add the addresses too.
Every way of connecting GitHub needs our addresses allowed:
| Connection | What it needs |
|---|---|
| GitHub App installation | Automatic entries from our app registration, or manual entries |
| GitHub OAuth (personal account sign-in) | Manual entries |
| GitHub Copilot (personal access token) | Manual entries |
The addresses GitHub adds from our app registration only apply to requests authenticated as the installed app. Requests made with an OAuth user token or a personal access token are still checked against your allow list, so add the addresses manually as well.
Let GitHub add our addresses automatically
Antenna’s IP addresses are registered on our GitHub App. When you install the app, enable Enable IP allow list configuration for installed GitHub Apps so GitHub adds our addresses to your allow list for you. See GitHub’s guide on allowing access by GitHub Apps .
Add the addresses manually
Add each address by hand so OAuth and token-based connections work, and to cover cases where the automatic option is unavailable or your allow list is managed at the enterprise level:
- Organization: Settings > Organization security > IP allow list, then select Add and enter each address.
- Enterprise: Enterprise settings > Authentication security > IP allow list, then add each address.
Troubleshooting
- Signing up or signing in with your GitHub account redirects you back to the login page: our request to GitHub’s user API was blocked. Add the addresses manually, then try again.
- GitHub is connected but GitHub Copilot reports an invalid token: the personal access token is valid, but our requests are blocked. Confirm the addresses were added manually rather than only through the GitHub App.