Git Integration

A git_repository connection ties an Orvanta workspace to a remote Git repository. It’s the connection type used by Git sync — see that page for what the connection does and does not do automatically today.

GitHub App

By default, a git_repository connection authenticates with a personal access token. Set its is_github_app flag instead and Orvanta authenticates through the GitHub App integration, which mints short-lived installation tokens rather than relying on a long-lived PAT. This also lets you scope exactly which repositories the Orvanta deployment can reach, independent of any one user’s token permissions.

GitHub App is an Orvanta Business or Enterprise feature.

Network requirements

The Orvanta-managed GitHub App requires your instance to reach https://stats.orvanta.ai to obtain GitHub installation tokens.

If your GitHub organization uses IP allow lists, whitelist the IP address behind stats.orvanta.ai so it can request installation tokens from GitHub on your instance’s behalf. Contact support for the current IP address.

This network requirement only applies to the Orvanta-managed GitHub App. With a self-managed GitHub App, your instance talks directly to your own GitHub instance instead — so if your GitHub organization uses IP allow lists, whitelist your Orvanta instance’s IP address there instead.

As a workspace admin, you can install the GitHub App against multiple organizations and link each installation to one or more Orvanta workspaces you administer.

The installation token issued this way is scoped to Git sync only — it isn’t a general-purpose credential.

Importing / exporting to/from another Orvanta instance

A GitHub App installation belongs to one GitHub organization at a time, so moving it to a second Orvanta instance means transferring the installation record rather than reinstalling the app. From the source instance, use the “Export” action on the installation to generate a JWT and copy it (the UI copies it to your clipboard automatically); on the destination instance, paste that JWT into the “Import” action to register the installation there.

That JWT carries the right to request installation tokens on the org’s behalf, so treat it like any other credential. To revoke it, uninstall the GitHub App from the organization and reinstall it to re-associate it with an Orvanta instance.

Self-managed GitHub App

Instead of the Orvanta-managed GitHub App, you can register your own GitHub App against any GitHub instance — GitHub.com or a GitHub Enterprise Server (GHES) deployment. Tokens are then exchanged directly between your Orvanta instance and your GitHub instance, with no dependency on stats.orvanta.ai.

This is an Enterprise Edition feature, configured at the instance level by a superadmin.

To set up a self-managed GitHub App:

1. Register a new GitHub App on your GitHub instance (github.com or your GHES instance).
2. In Orvanta Instance Settings, go to Advanced > GitHub Enterprise App and enable “Self-managed GitHub App (for GHES or custom GitHub App)”.
3. Fill in the app details: Base URL (e.g. https://github.com or your GHES URL), App ID, App Slug, Client ID, and Private Key (PEM).
4. Install the GitHub App to your organization on your GitHub instance.

Once configured, the self-managed GitHub App authenticates Git sync the same way the Orvanta-managed one does — the difference is entirely in where the installation and its tokens live: your own GitHub instance instead of Orvanta’s.