thanks for the details - I was looking at the fine grained token but the user would then have to provide me with the the token and then I'd have to store that on my end - since i'm trying to avoid storing any user data that doesn't really play into the structure at all

with regards to the public token thing it's a bit of the same complexity since I would need to know if the repository the user is using is public or private and then configure the OAuth scopes appropriately since I do want to have support for private repos (as that's how I use it currently)