> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/developer-tools/integrations/scm-integrations/organization-level-integrations/github-cloud-app.md). # GitHub Cloud App How to set up the Snyk GitHub Cloud App integration, including use with Universal Broker {% hint style="info" %} **Snyk is rolling out a new navigation.** The steps on this page describe the classic interface. If your view looks different, visit [Navigate the Snyk Web UI](https://docs.snyk.io/navigate-the-snyk-web-ui#where-things-moved) to map these options to the new interface. {% endhint %} ## GitHub Cloud App {% hint style="info" %} **Feature availability** If you are using Broker, visit the [GitHub Cloud App for Universal Broker](/developer-tools/integrations/scm-integrations/scm-integrations-and-snyk-broker.md#github-cloud-app-for-universal-broker) documentation. If you want to use your own GitHub App, contact your Snyk account team. {% endhint %} ### Prerequisites for GitHub Cloud App * Snyk Organization Admin user role. * GitHub Organization Admin user role. * A public, internal, or private GitHub repository. * The required app permissions. For more information, visit [GitHub Cloud App permission requirements](/developer-tools/integrations/scm-integrations/user-permissions-and-access-scopes.md#github-cloud-app-permission-requirements). {% hint style="info" %} Users can install the app on GitHub Organizations they are Repository Admins on through the GitHub UI. The GitHub Cloud App integration is available at the Organization level within the Snyk Web UI. {% endhint %} ### GitHub Cloud App benefits The GitHub Cloud App improves on many features as compared to the current GitHub integration, including role-based, granular access control, increased API rate limits, and\ a foundation for an enhanced developer experience. * Role-Based Access Control (RBAC) Compliance: The GitHub Cloud App decouples access control from user accounts, linking it to the app. This separation improves the management and enforcement of RBAC policies at the application level instead of individual accounts. * Granular access control: The GitHub Cloud App allows fine-grained control over repository-level access permissions. * The GitHub Cloud App provides a higher rate limit, enabling Snyk to make more requests and helping manage large-scale cases such as monorepos and organizations with many repositories. * Enabler for an enhanced developer experience: * Pull request checks: The Checks tab in GitHub is only accessible through the Cloud App, providing an SCM-native experience for potential future PR check workflow improvements. * Fix and upgrade pull requests: The GitHub App performs Snyk-initiated pull requests directly rather than going through a service account. ### How to set up the GitHub Cloud App {% hint style="warning" %} When setting up the GitHub Cloud App, you can only implement one of the following scenarios: * One GitHub organization connected to one Snyk Organization * One GitHub organization connected to multiple Snyk Organizations {% endhint %} Log in to your Snyk account and navigate to the Integrations section in the Snyk Organization where you would like to set up the GitHub Cloud App. Select the **GitHub Cloud App** tile.

GitHub Cloud App tile on the Integrations page

In the confirmation modal, click **Configure GitHub Cloud App**.

Configuration notice for the GitHub Cloud App

The app then asks you to authorize it to act on your behalf, so it can check which GitHub organizations you can install it in.

When the install screen in GitHub opens, you can select the GitHub organization where you wish to install the app.

Selection of the GitHub organization to install the app into

If the GitHub Cloud App is already installed in a GitHub organization, you can select that same GitHub organization during the integration process for a different Snyk Organization.

Connect another GitHub organization into a Snyk Organization

Specify whether to install the app in all repositories in the selected GitHub organization or in only some of them. Then click **Install & Authorize**.

Install and authorize settings for the GitHub organization you are installing the GitHub Cloud App into — Install and authorize settings for the GitHub organization
you are installing the GitHub Cloud App into

{% hint style="warning" %} The GitHub Cloud App loses access to Snyk if you uninstall it from the GitHub organization or edit the repositories that the app instance can access. {% endhint %} ## Configuring IP allowlists {% hint style="info" %} The GitHub Cloud App has no pre-configured IP addresses. Contact your Snyk account team for the Snyk IP addresses to add manually. {% endhint %} If an IP allowlist protects access to your GitHub Cloud or Enterprise Cloud repositories, add the Snyk IP addresses to enable communication with your SCM tool. IP allowlists at the Enterprise level override those at the Organization level in GitHub Enterprise Cloud, so you must add the Snyk IP addresses to both levels. ### Configuring the allowlist at the Organization level {% hint style="warning" %} You must be a GitHub Organization admin to perform this. {% endhint %} Follow GitHub's instructions for [adding an allowed IP address](https://docs.github.com/en/enterprise-cloud@latest/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-allowed-ip-addresses-for-your-organization#adding-an-allowed-ip-address), and enter the Snyk IP addresses in the form fields. ### Configuring the allowlist at the Enterprise level {% hint style="warning" %} You must be a GitHub Enterprise admin to perform this. {% endhint %} Follow GitHub's instructions for [adding an allowed IP address](https://docs.github.com/en/enterprise-cloud@latest/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-allowed-ip-addresses-for-your-organization#adding-an-allowed-ip-address), and enter the Snyk IP addresses in the form fields. ## How to migrate to the GitHub Cloud App If you are an Enterprise plan customer, you can migrate Snyk Targets to the GitHub Cloud App using the [snyk-migrate-to-github-app](https://github.com/snyk-labs/snyk-migrate-to-github-app) tool in the [tool repository](https://github.com/snyk-labs/snyk-migrate-to-github-app). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.snyk.io/developer-tools/integrations/scm-integrations/organization-level-integrations/github-cloud-app.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.