Configure GitHub access changedclaude-tag/admins/configure-github
Nearest release: v2.1.290, published 4 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 5 Oct 2026 22:28 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 22 Oct 2026 18:07 UTC.
Upstream edited
Recorded here
Lines+11added
Lines−11removed
From line
8
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits19to this page, all time
The whole hunk
from line 8, old and new numbered
/
from line 8
88
99> [!TIP]
1010>
11> Using GitLab instead of GitHub? See [Configure GitLab access](/docs/claude-tag/admins/configure-gitlab). GitLab uses a service-account token rather than an installed app.
11> Using GitLab instead of GitHub? See [Configure GitLab access](/docs/claude-tag/admins/configure-gitlab.md). GitLab uses a service-account token rather than an installed app.
1212
1313Claude Tag gives Claude its own GitHub identity, the Claude GitHub App, so pull requests it opens from a channel or a DM are authored by Claude rather than by a person. You only need GitHub access if a team will hand Claude code work: branches, pull requests, review, or CI follow-up.
1414
from line 40
4040
4141## Grant repository access
4242
43The remaining steps are in Claude Tag admin settings, not GitHub's settings. Granting repositories requires the **Owner** role or the [**Claude Tag Admin** permission](/docs/claude-tag/admins/restrict-access#delegate-claude-tag-administration) in your Claude organization. A [channel manager](/docs/claude-tag/admins/restrict-access#delegate-channel-setup-to-channel-managers) can also add repositories to their own channel, limited to repositories their GitHub account is an admin of.
43The remaining steps are in Claude Tag admin settings, not GitHub's settings. Granting repositories requires the **Owner** role or the [**Claude Tag Admin** permission](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) in your Claude organization. A [channel manager](/docs/claude-tag/admins/restrict-access.md#delegate-channel-setup-to-channel-managers) can also add repositories to their own channel, limited to repositories their GitHub account is an admin of.
4444
4545The GitHub page, a bundle's page, and a workspace's or channel's own page each offer the repositories the Claude GitHub App's installations reach, so you can grant a repository that no bundle holds yet. Pick repositories for each place on the GitHub page, or put them in a bundle to give a group of places the same set.
4646
from line 66
6666
6767### Grant repositories through a bundle
6868
69A [bundle](/docs/claude-tag/admins/add-connections#create-a-bundle)'s places decide which channels can use the repositories in it.
69A [bundle](/docs/claude-tag/admins/add-connections.md#create-a-bundle)'s places decide which channels can use the repositories in it.
7070
7171**1. Open a bundle**
7272
from line 84
8484
8585* The GitHub organization shows as **Connected** in the **GitHub** section at [`claude.ai/admin-settings/source-control`](https://claude.ai/admin-settings/source-control).
8686* On the **Connectors** tab under **Claude's access**, select **GitHub**. Its page shows how many GitHub accounts the Claude GitHub App is installed on. Its **Access from** table lists each repository picked for a place and each repository a bundle holds. The **Set by** column reads **Here** for a repository picked for a place, or names the bundle that holds it, and **Used at** names where each one applies.
87* For the end-to-end check, open a draft PR from a test channel; see [Verify the bundle is live](/docs/claude-tag/admins/attach-to-scope#verify-the-bundle-is-live).
87* For the end-to-end check, open a draft PR from a test channel; see [Verify the bundle is live](/docs/claude-tag/admins/attach-to-scope.md#verify-the-bundle-is-live).
8888
8989### If Claude can't reach a repository
9090
from line 112
112112
113113[Hooks](https://code.claude.com/docs/en/hooks) in a repository's `.claude/settings.json` don't run in the session. A repository's `.mcp.json` is never loaded.
114114
115Repository skills apply only in sessions that have the repository. To give a skill to every channel under a scope, add it through a [skills repository](/docs/claude-tag/admins/skills-repo).
115Repository skills apply only in sessions that have the repository. To give a skill to every channel under a scope, add it through a [skills repository](/docs/claude-tag/admins/skills-repo.md).
116116
117117### Install project dependencies
118118
119119Every session runs in an isolated sandbox with a standard set of preinstalled tools. There are two places to add what a project needs beyond that set, such as a specific language runtime or a database client:
120120
121* **For every session in a channel**, an admin adds the install commands to the setup script of the environment the channel's sessions run on. See [Configure the environment for a scope](/docs/claude-tag/admins/customize#configure-the-environment-for-a-scope).
121* **For every session in a channel**, an admin adds the install commands to the setup script of the environment the channel's sessions run on. See [Configure the environment for a scope](/docs/claude-tag/admins/customize.md#configure-the-environment-for-a-scope).
122122* **For one repository**, add the install commands to the repository's `CLAUDE.md`.
123123
124124Claude follows `CLAUDE.md` as guidance when it starts work that needs it, not as an unconditional setup step. Write each install as a precondition of the work it supports, for example "install the SDK before building or running tests", so Claude runs it when a task touches that code. The sandbox is fresh for every session, so the installs repeat each time Claude works in the repository.
125125
126Prefer the standard package manager and its default registry over a vendor install script or a third-party package source. Package managers such as `apt`, `pip`, `npm`, and `dotnet` reach their default registries from the sandbox; downloads from other hosts can be blocked at the sandbox's [egress boundary](/docs/claude-tag/concepts/security-and-data#network-egress). An Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access#delegate-claude-tag-administration) can allow an additional host with a domain entry on a bundle; see [Allow a host without a credential](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential).
126Prefer the standard package manager and its default registry over a vendor install script or a third-party package source. Package managers such as `apt`, `pip`, `npm`, and `dotnet` reach their default registries from the sandbox; downloads from other hosts can be blocked at the sandbox's [egress boundary](/docs/claude-tag/concepts/security-and-data.md#network-egress). An Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) can allow an additional host with a domain entry on a bundle; see [Allow a host without a credential](/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential).
127127
128128## What Claude can do with GitHub Actions
129129
130In a channel, Claude acts on GitHub as the Claude GitHub App, and that identity carries a fixed set of GitHub Actions permissions. No admin setting changes it, and adding `api.github.com` as a [custom connector](/docs/claude-tag/admins/connections/custom) with your own token doesn't change it either; Claude's GitHub requests always act as the Claude GitHub App.
130In a channel, Claude acts on GitHub as the Claude GitHub App, and that identity carries a fixed set of GitHub Actions permissions. No admin setting changes it, and adding `api.github.com` as a [custom connector](/docs/claude-tag/admins/connections/custom.md) with your own token doesn't change it either; Claude's GitHub requests always act as the Claude GitHub App.
131131
132132Claude can:
133133
from line 175
175175
176176#### GitHub Enterprise Server in direct messages
177177
178In a [one-to-one direct message](/docs/claude-tag/concepts/agent-identity#direct-message-channels), Claude reaches repositories on a registered host through the sender's own GitHub Enterprise account instead of the bundle's grants. Claude adds a repository to a DM session only when both of these are true:
178In a [one-to-one direct message](/docs/claude-tag/concepts/agent-identity.md#direct-message-channels), Claude reaches repositories on a registered host through the sender's own GitHub Enterprise account instead of the bundle's grants. Claude adds a repository to a DM session only when both of these are true:
179179
180180* The sender's GitHub Enterprise account has push access to the repository
181181* Your GitHub App's installation on the instance includes the repository
from line 186
186186
187187## Related resources
188188
189* [Configure per-channel access](/docs/claude-tag/admins/attach-to-scope): add the bundle to the workspaces and channels that need it
190* [Set up routines](/docs/claude-tag/users/proactivity): the scheduled jobs that use this connection
189* [Configure per-channel access](/docs/claude-tag/admins/attach-to-scope.md): add the bundle to the workspaces and channels that need it
190* [Set up routines](/docs/claude-tag/users/proactivity.md): the scheduled jobs that use this connection
191191
No line in this hunk matches that.