The GitHub REST API is the canonical surface for interacting with GitHub.com programmatically — almost anything you can do in the UI is available via API: create repos, manage issues and PRs, read/write files, trigger Actions, manage team permissions. It coexists with the GitHub GraphQL API — REST is great for simple CRUD; GraphQL is better when you need to fetch related data in one call without N+1 traffic.

Authentication options include personal access tokens (PATs, both classic and fine-grained), GitHub Apps, OAuth Apps, and the GITHUB_TOKEN that's automatically available inside Actions workflows. Fine-grained PATs are the modern, recommended path — they scope down to specific repos and minimal operation sets, ideal for server-side integrations. GitHub Apps go further with per-installation isolation, suitable when distributing to multiple organizations.

Rate limits are the most common friction: 60/h unauthenticated, 5000/h authenticated, plus a secondary rate limit that throttles bursts. Webhooks cover essentially every repo event, and combined with GitHub Apps enable sophisticated automation pipelines. GraphQL queries have a cost budget — overly complex nested queries can be rejected for exceeding it.