listMembershipsForAuthenticatedUser returns different results with a personal token vs user to server token.

[rachellerathbone]

Hi there. I'm working on the GitHub for Jira integration and we want to update the page where a user is prompted to Install the app in a GitHub org to display any org where role === admin, regardless of whether the GitHub for Jira app is installed or not (currently it only shows all orgs except those that don't have Jira installed regardless of whether a user is admin or not).

When I call listMembershipsForAuthenticatedUser with a personal access token, I get back all orgs which would allow me to filter out those where I'm not an admin and cross reference with some other data I have so we can correctly flag whether an org has Jira installed or not. However, when I use a user to server token that's generated in our app, I only get back the orgs that have the app installed where I am also admin.

Can someone help me understand why I'm getting different data back for different token types? I've tried tweaking the permissions in my GitHub app but didn't have any luck. We're using Octokit in our app but I've tried hitting the https://api.github.com/user/memberships/orgs endpoint in Postman and still get the same results. The docs don't mention what permissions need to be set for this to work so wondering if I'm just missing something.

[gr2m]

However, when I use a user to server token that's generated in our app, I only get back the orgs that have the app installed where I am also admin.

That's by design, user-to-server tokens are limited by the app's access and permissions.

If you want to list all organizations, then you will have to either prompt the user to manually create and provide a personal access token with the read:org scope (you can create a deep link, not sure if you can set expiration with query parameters though), or use a separate OAuth App with at least the read:org scope. Because you only want orgs where the user is admin, you won't need to additionally grant or request access for the OAuth app to these orgs.

I'd suggest you try the OAuth App path and see if that works for you