How do I create a GitHub App for Claude Code to ensure it has its own identity?

Create one GitHub App for Claude Code, then give it short-lived installation tokens. A shared app shows every agent as the same bot.

The GitHub Docs describe the steps below. I did not check Claude Code's own docs, so you must connect the app's tokens to Claude Code yourself.

Steps

1. Open Settings > Developer settings > GitHub Apps > New GitHub App. The docs say the name cannot be longer than 34 characters and must be unique across GitHub. (Registering a GitHub App)
2. Deselect Active if the app does not need webhooks. The same page lists this as an optional step.
3. Under Permissions, choose the minimum you need. For git push over HTTPS, select the Contents repository permission. (Choosing permissions)
4. Under Where can this GitHub App be installed?, select Only on this account.
5. Click Create GitHub App.
6. Generate a private key under Credentials > Key pairs > New key. GitHub downloads a PEM file. Store it in a key vault. The docs say an environment variable is a weaker option. (Managing private keys)
7. Install the app on one repository only. (Installing your own GitHub App)
8. Create an installation token for each run. Send a POST to /app/installations/INSTALLATION_ID/access_tokens with a signed JWT. Pass repositories and permissions to limit the token. (Generating an installation access token)
9. Use the token for Git. Run git clone https://x-access-token:TOKEN@github.com/owner/repo.git. (Choosing permissions)

Limits you must plan for

• Token lifetime: An installation token expires after 1 hour. Generate a new one for each run. (Generating an installation access token)
• Private key risk: The private key grants access to every account where the app is installed. Keys do not expire. You can create up to 25 keys. (Managing private keys)
• Attribution: Installation tokens attribute activity to the app, not to a user. (Best practices) Test one push and check the commit author before you rely on it.
• Tooling: The GitHub Actions example uses actions/create-github-app-token. I could not check that repository's maintenance signals, so verify it before you use it.

Recommendation

Use one GitHub App for each agent. Restrict each installation to one repository. Mint a token per run, and do not reuse the private key in shared code.

If you run more than one agent, githug sets up this pattern for you. Each agent gets its own key. The key mints one-hour tokens for one repository through a GitHub App. Its commits show the agent as author, with trailers that name the accountable human. The hug init --repo owner/repo command sets it up for Claude Code, and it is free during the beta.