Why is rate limit similar with authorized and anonymous access to GitHub API?

user_13448436 0
Viewed 224

When I send request with Postman and check response header I can see this:

enter image description here

When I try with old PAT I created, or with OAuth token after validation (I created app and validated user with OAuth flow from my DB, so I used this token in Postman just to check) to call GitHub REST API like this: https://api.github.com/repos/djordjeviclazar/rep/branches and set access_token in header like in documentation, I can see in headers X-RateLimit-Limit is 60, and I could see that X-RateLimit-Remaining is less than 60.

From documentation:

For API requests using Basic Authentication or OAuth, you can make up to 5,000 requests per hour.

Authenticated requests are associated with the authenticated user, regardless of whether Basic Authentication or an OAuth token was used. This means that all OAuth applications authorized by a user share the same quota of 5,000 requests per hour when they authenticate with different tokens owned by the same user.

So I guess that means I can't make more tokens and expect more than 5000 requests per hour, but why only 60, why API treats my requests as anonymous? Also I think that Search API is more limiting. What is the right way to access GitHub REST API?

github-api
1 Answers

The issue is that this call is not authenticated since you've specified:

  • Add To Headers
  • Key: access_token
  • Value: {{PAT}}

It will add an HTTP header with the following value: access_token: [PAT value] which is not processed by Github.

Checkout the headers sent in the headers tab it should print Authorization: Token YOUR_TOKEN or Authorization: Bearer YOUR_TOKEN

The following configuration will work correctly:

enter image description here

  • Add To Headers
  • Key: Authorization
  • Value: Token {{PAT}} (also Bearer {{PAT}} works)

You can also use Authorization of Type Bearer Token which is the same as Bearer XXXX:

enter image description here

Also, you can also disable Authorization (to the value No), and in the headers, just append the Authorization header:

enter image description here

Note that the usage of access_token in the url query parameters has been deprecated since end 2019

user_26143640
Related