Calling the GitHub GraphQL API from an app

For a migration from Disqus over to GitHub Discussions, I created a script that processes all comments and replies. One thing I noticed is that I quickly reached the rate limit with my personal access token, which prevents me from using GitHub for a while.

I decided to use a GitHub App to overcome the issue of locking out my account. That way, when the app reaches the rate limit, I can still use GitHub. Although, one thing I just learned was that you need to get the installation token to call the GraphQL API.

In this article, I’ll explain how you can call the GraphQL API from a GitHub App.

App creation

The GitHub Apps page is where you create a new GitHub App.

For calling the GraphQL API, you need to specify the name, and URL, turn off the webhook functionality and provide the required permissions.

Once you have created the app, you can generate a client secret and copy it as you need later.

Generate a new private key and keep the *.pem file safe.

App installation

On the install app page, install the app to all or the repositories of your choice.

Show image

Get an access token

As mentioned, to call the GraphQL API, you must get an installation token. The retrieval of the token comes in two steps:

1. Authenticate the GitHub App to get a JWT token;
2. Use the JWT token to retrieve the installation ID;
3. Use the JWT token to retrieve the installation’ access token.

To get the JWT token, you will need the GitHub app ID, client ID, client secret, and private key. To simplify the code, you can use @octokit/auth-app.

1
import { createAppAuth } from "@octokit/auth-app";
2
import { readFileSync } from "fs";
3

4
const auth = createAppAuth({
5
  appId,
6
  privateKey: readFileSync(join(__dirname, "../../", privateKeyFile), "utf8"),
7
  clientId,
8
  clientSecret
9
});
10

11
// Retrieve JSON Web Token (JWT) to authenticate as app
12
const appAuthentication = await auth({ type: "app" });
13

14
if (!appAuthentication.token) {
15
  throw new Error("Could not retrieve JWT token");
16
}
17

18
const installationResponse = await fetch("https://api.github.com/app/installations", {
19
  method: 'GET',
20
  headers: { Authorization: `Bearer ${appAuthentication.token}` }
21
});
22

23
if (!installationResponse.ok) {
24
  throw new Error(`HTTP error! status: ${installationResponse.status}`);
25
}
26

27
const installations = await installationResponse.json();
28
// Get the installation you are interested in (in my case only the first one)
29
const installationId = installations[0].id;
30

31
 // Get installation access token
32
const installationAuthentication = await auth({
33
  type: "installation",
34
  installationId,
35
});
36

37
if (!installationAuthentication.token) {
38
  throw new Error("Could not retrieve installation token");
39
}

Once you have the installation’s access token, you can call the GraphQL API.

1
const response = await fetch("https://api.github.com/graphql", {
2
  method: 'POST',
3
  headers: { Authorization: `Bearer ${installationAuthentication.token}` },
4
  body: JSON.stringify({
5
    query: `
6
      query {
7
        ...
8
      }
9
    `
10
  }),
11
}).then((r) => r.json());