OAuth App authorization button remains disabled — supported diagnostic steps?

[AdamsTong72]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Apps

Body

We are troubleshooting an OAuth App authorization flow on GitHub.com.
In a Chrome browser on Windows, using an isolated temporary profile,
the GitHub authorization page displays a visible “Authorize” button
that remains disabled throughout a 60-second observation window.

The application’s own consent page works through its normal visible
controls. We checked that the runtime client_id and redirect_uri
match the OAuth App configuration. The authorization request includes
state and a PKCE S256 challenge.

We did not modify the disabled attribute, submit the GitHub form
programmatically, or bypass any checks. No authorization code was obtained.

In one diagnostic capture window, we recorded zero uncaught page
exceptions, one error-level log event, one aborted resource load,
and one HTTP 404 response. Our summary did not retain per-event
correlation, so these observations do not rule out a scripting or
resource-loading problem.

We have not reliably confirmed the account’s email-verification status.

What supported steps can distinguish:

• an unmet account or email-verification requirement;
• an OAuth App restriction;
• a browser or page-resource problem?

In particular, how can we reliably confirm the relevant account
preconditions in the current GitHub UI?

Please suggest diagnostics that do not require sharing secrets,
cookies, authentication URLs, state values, PKCE verifiers or tokens.

[UJJWAL-2027]

Hi,

Since the OAuth request parameters have already been checked, I'd separate account prerequisites from browser-side failures before changing the OAuth configuration.

Here are a few checks I'd suggest:

1. Verify the account's email status: In GitHub, open Settings → Emails and check whether the relevant email address is verified. If it isn't, complete GitHub's normal verification flow and then retry authorization.

2. Check account and application restrictions: Review any notices shown on GitHub's authorization page and check whether the account or organization has restrictions affecting the OAuth App. If this is an organization-owned resource, an organization administrator may need to review its third-party application access policies.

3. Isolate browser-related issues: Try a current, supported browser with extensions disabled, or a fresh browser profile. If the button works in another environment, compare browser extensions, privacy settings, and blocked resources.

4. Correlate the browser diagnostics: A 404 response or aborted resource load alone doesn't establish the cause. Record the failing resource's URL path, status, and timing, while redacting query parameters and sensitive information. Use the browser's Network panel to determine whether the failed resource is associated with the authorization page.

5. Retry using GitHub's normal authorization flow: Avoid manipulating the disabled button or submitting the form programmatically. If the issue persists across clean browser profiles after the account prerequisites are confirmed, collect the timestamp, browser version, sanitized console errors, and relevant HTTP status codes for GitHub Support.

I would start with Settings → Email , since the email-verification status hasn't been confirmed yet. These checks should help narrow down the issue without exposing OAuth secrets or bypassing GitHub's authorization controls.

Hope this helps!

[BenkhiraAhmedBaderEddine1]

Hi,

I’d recommend checking the following steps to identify why the GitHub OAuth authorization button remains disabled.

1. Verify your email address
Go to https://github.com/settings/emails and confirm that your primary email address is marked as Verified. If it isn't, complete the email verification process and try the authorization flow again.

2. Check OAuth App restrictions
Make sure the OAuth App is active and that your organization hasn't restricted or blocked it. If your organization uses SAML SSO or requires approval for OAuth Apps, you may need to complete those steps first.

3. Troubleshoot the browser
Try the authorization flow in a fresh Chrome profile with extensions disabled. Open Chrome DevTools, select the Network tab, enable Preserve log, and reload the page. Check which resource returns the 404 response and whether any JavaScript errors occur when the page loads.

A 404 error or an aborted resource request alone doesn't necessarily explain why the Authorize button is disabled. Look for a direct connection between the failed request and the page behavior.

4. Verify the OAuth configuration
Since you've already checked the client_id, redirect_uri, state, and PKCE parameters, confirm that the callback URL matches the registered configuration, the requested scopes are valid, and the PKCE challenge uses S256 correctly.

You can find more details in GitHub's official documentation:
https://docs.github.com/en/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps

5. Contact GitHub Support if the issue persists
If the email is verified, the app configuration is correct, and the button remains disabled across clean browser sessions, contact GitHub Support at https://support.github.com/contact.

Include the browser version, timestamp, sanitized network errors, and reproduction steps. Do not share cookies, access tokens, authorization codes, PKCE verifiers, or complete authorization URLs.

I'd start by confirming the email verification status, since it's an important prerequisite. Then investigate the failed network request to determine whether the issue is related to GitHub's authorization page or your application's configuration.

Hope this helps!