Registers jwt and oauth-provider with every plugin route but authorize, consent and continue blocked over HTTP. Apps are session-only: create shows the secret once, rotate replaces it, delete revokes the app's keys for every user, and gh cannot be changed. Callbacks follow GitHub's host, port and path rule.