Returns a GitHub App install authorization URL plus a signed state token. Headless flow:
{ provider }.{ authorization_url, state, expires_at }.git_connection row.GET /v1/apps/:appId/git until { connected: true }.The state token is HMAC-signed (10-minute TTL) and binds the OAuth callback to the originating app + tenant + provider. Each call mints a fresh nonce — no replay across attempts.
Returns 503 git_connect_not_configured when the GitHub App slug cannot be resolved from GET /app.
Application ID for tenant scoping. X-Outerlayer-App-Id is accepted as an equivalent header.
API key (sk_agentmark_*)
github Authorization URL minted.