# Deploy api\_key: "GITHUB OAUTH TOKEN" ambiguity **URL:** \ **Category:** Travis CI Discussions & Feedback\ **Tags:** documentation\ **Created:** [September 13, 2019, 1:52pm UTC](https://travis-ci.community/t/deploy-api-key-github-oauth-token-ambiguity/5092 "2019-09-13T13:52:06Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![biocodz](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/biocodz/32/2714_2.png) [@biocodz](https://travis-ci.community/u/biocodz)\ **Post date:** [September 13, 2019, 1:52pm UTC](https://travis-ci.community/t/deploy-api-key-github-oauth-token-ambiguity/5092/1 "2019-09-13T13:52:06Z")
Looking at the [docs Deployment page](https://docs.travis-ci.com/user/deployment/) it’s not at all obvious to me what exactly `api_key: "GITHUB OAUTH TOKEN"` means. Should I use “GITHUB OAUTH TOKEN” literally as shown, or is it a placeholder for a token, which should be used in place of “GITHUB OAUTH TOKEN”? From quite a long research on the Net, it seems the meaning is indeed the Personal Access Token, which have to be generated specifically for the task of uploading. However the interpretation of using “GITHUB OAUTH TOKEN” literally can be justified. Travis already has access to my GitHub account, as can be seen on `Authorized OAuth Apps` list on my account settings, and uses an OAUTH token for this, so “GITHUB OAUTH TOKEN” may quite well refer to that token. There is a whole story behind the “GITHUB OAUTH TOKEN”, which the docs completely fail to hint. ---
**Author:** ![native-api](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/native-api/32/430_2.png) [@native-api](https://travis-ci.community/u/native-api)\ **Post date:** [September 13, 2019, 7:34pm UTC](https://travis-ci.community/t/deploy-api-key-github-oauth-token-ambiguity/5092/2 "2019-09-13T19:34:16Z")
It’s a placeholder. [https://docs.travis-ci.com/user/deployment/releases/#authenticating-with-an-oauth-token](https://docs.travis-ci.com/user/deployment/releases/#authenticating-with-an-oauth-token) has the information about this token. The code you are viewing is, as the section’s title says, “Examples of Conditional Deployment”, not an authoritative documentation for the Github Releases deployment. They are showcasing a completely different thing. ---
**Author:** ![BanzaiMan](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/banzaiman/32/67_2.png) [@BanzaiMan](https://travis-ci.community/u/BanzaiMan)\ **Post date:** [September 14, 2019, 1:03am UTC](https://travis-ci.community/t/deploy-api-key-github-oauth-token-ambiguity/5092/3 "2019-09-14T01:03:35Z")
Thanks for explaining your confusion. As mentioned above by @native-api, `GITHUB OAUTH TOKEN` is meant to be a place holder. I appreciate the explanation that it could be construed as a special magic sequence to make something magical happen; it is a balancing act to find how we should explain these things. If you have a better idea to explain it, we appreciate your contribution (by clicking on the button on the upper right corner). ---
**Author:** ![biocodz](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/biocodz/32/2714_2.png) [@biocodz](https://travis-ci.community/u/biocodz)\ **Post date:** [September 16, 2019, 1:36pm UTC](https://travis-ci.community/t/deploy-api-key-github-oauth-token-ambiguity/5092/4 "2019-09-16T13:36:33Z")
I appreciate the replies to this confusion of mine. @BanzaiMan - thumbs up for the ‘magic sequence’ metaphor:-) @native-api I believe to have seen the example you are mentioning. Calling the same things different names in different parts of doc like ‘GITHUB\_OAUTH\_TOKEN’ and then ‘YOUR\_API\_KEY\_ENCRYPTED’ arguably raises doubts, but not clears them. I sure understand the difficulties of writing the docs. The name for the placeholder would be arguably less ambiguous if written as `YOUR_GITHUB_OAUTH_TOKEN`. But certainly a more descriptive explanation would be even better. I dare say have some experience with GitHub and Travis, and still spent embarrassingly long time to figure the things out. I would be happy to find in the docs the following details: The user is assumed to be familiar with the [Public-key cryptography](https://en.wikipedia.org/wiki/Public-key_cryptography) “GITHUB OAUTH TOKEN” is a GitHub ‘Personal Access Token’ that needs to be generated on GitHub, and encrypted using the Travis Public RSA Key. The encrypted string then can be used as “GITHUB OAUTH TOKEN” on the Travis Yaml configuration file. 1. Generate a GitHub ‘Personal Access Token’ [HERE](https://github.com/settings/tokens) with the following scopes: read:org user:email repo\_deployment repo:status write:repo\_hook public\_repo 2. Obtain the Tavis public RSA key for your Git repository (say facebook/rocksdb) `wget https://api.travis-ci.org/repos/facebook/rocksdb/key` 3. Encrypt the Token using the RSA key and OpenSSL, or travis Ruby client. A ‘long cypher string’ is returned `echo -n 'GITHUB_OAUTH_TOKEN' | openssl pkeyutl -encrypt -inkey travis_rsa_pubkey.pem -pubin | base64 -w0` 4. Use the encrypted value i.e. the ‘long cypher string’ on the Travis Yaml My hat is off for the authors of the following references: 1. [How to publish artifacts in Travis CI?](https://stackoverflow.com/questions/12343452/how-to-publish-artifacts-in-travis-ci/33109519#33109519) 2. [Travis Issue #2982: How does “travis encrypt” work?](https://github.com/travis-ci/travis-ci/issues/2982) 3. [GitHub Releases Uploading](https://docs.travis-ci.com/user/deployment/releases/) Voila, something like that.