diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c6a4fc07..2a45b20a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -51,6 +51,7 @@ jobs:
         run: ./scripts/Write-Secrets.ps1
         env:
           GOOGLE_DRIVE_API_SECRET: ${{ secrets.GOOGLE_DRIVE_API_SECRET }}
+          GITHUB_OAUTH_SECRET: ${{ secrets.MY_GITHUB_OAUTH_SECRET }}
 
       - name: Build Solution
         run: dotnet build -c Release -property:Version="${{ steps.get-build-version.outputs.build-version }}" -warnaserror
diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml
index 855fe117..bd408329 100644
--- a/.github/workflows/pr-build.yml
+++ b/.github/workflows/pr-build.yml
@@ -46,6 +46,7 @@ jobs:
         run: ./scripts/Write-Secrets.ps1
         env:
           GOOGLE_DRIVE_API_SECRET: ${{ secrets.GOOGLE_DRIVE_API_SECRET }}
+          GITHUB_OAUTH_SECRET: ${{ secrets.MY_GITHUB_OAUTH_SECRET }}
 
       - name: Build Solution
         run: dotnet build -c Release -warnaserror
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bbea3d5d..12b68642 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -47,6 +47,7 @@ jobs:
         run: ./scripts/Write-Secrets.ps1
         env:
           GOOGLE_DRIVE_API_SECRET: ${{ secrets.GOOGLE_DRIVE_API_SECRET }}
+          GITHUB_OAUTH_SECRET: ${{ secrets.MY_GITHUB_OAUTH_SECRET }}
 
       - name: Build Solution
         run: dotnet build -c Release -property:Version="${{ steps.get-build-version.outputs.build-version }}" -warnaserror
diff --git a/scripts/Write-Secrets.ps1 b/scripts/Write-Secrets.ps1
index 3d28559b..697aeedb 100644
--- a/scripts/Write-Secrets.ps1
+++ b/scripts/Write-Secrets.ps1
@@ -17,6 +17,7 @@ $ReplacementScriptBlock = {
 
     switch ($SecretName) {
         "GOOGLE_DRIVE_API_SECRET" { $SecretValue = $env:GOOGLE_DRIVE_API_SECRET }
+        "GITHUB_OAUTH_SECRET" { $SecretValue = $env:GITHUB_OAUTH_SECRET }
         default { throw "Invalid secret name $SecretName" }
     }
 
diff --git a/src/Tql.App/Services/Synchronization/GoogleDriveBackupProvider.cs b/src/Tql.App/Services/Synchronization/GoogleDriveBackupProvider.cs
index 9f696415..1fa30c60 100644
--- a/src/Tql.App/Services/Synchronization/GoogleDriveBackupProvider.cs
+++ b/src/Tql.App/Services/Synchronization/GoogleDriveBackupProvider.cs
@@ -57,7 +57,7 @@ private Task<UserCredential> GetCredentials(CancellationToken cancellationToken)
 
     private string GetClientSecret()
     {
-#if !DEBUG
+#if DEBUG
         return Environment.GetEnvironmentVariable("GOOGLE_DRIVE_API_SECRET")!;
 #else
         return Encoding
diff --git a/src/Tql.DebugApp/packages.lock.json b/src/Tql.DebugApp/packages.lock.json
index dccb85d3..134cbc3a 100644
--- a/src/Tql.DebugApp/packages.lock.json
+++ b/src/Tql.DebugApp/packages.lock.json
@@ -805,6 +805,15 @@
         "resolved": "6.8.0",
         "contentHash": "WBu15cdv1lqKkPKXDQOEmEzwKemwrczKYlc2jtuZgRYiZ8TG8F4QzPYiE0Q9eVIpMSk8Aky7mUephf19HjBPOw=="
       },
+      "OAuth2": {
+        "type": "Transitive",
+        "resolved": "0.10.3",
+        "contentHash": "Yg5OaNfNrUq2HN0LNcxGL9plMh3XC9fja1/iTVZB96D7UwIxk0iq9irN0EbvardXlALUIIv3NKz6CVRHk+1Mxg==",
+        "dependencies": {
+          "Newtonsoft.Json": "13.0.2",
+          "RestSharp": "106.12.0"
+        }
+      },
       "Octokit": {
         "type": "Transitive",
         "resolved": "9.0.0",
@@ -818,6 +827,11 @@
           "Newtonsoft.Json": "13.0.1"
         }
       },
+      "RestSharp": {
+        "type": "Transitive",
+        "resolved": "106.12.0",
+        "contentHash": "irOsQHe5nTJB0BKxGQnTX1dsgCPl5dLTxvL7gbl98JiFPiHMN4wpFyUG/66ZpaFCsIrPKh6XwozWXlwYe9JwYQ=="
+      },
       "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl": {
         "type": "Transitive",
         "resolved": "4.3.0",
@@ -1991,6 +2005,7 @@
         "type": "Project",
         "dependencies": {
           "HtmlAgilityPack": "[1.11.54, )",
+          "OAuth2": "[0.10.3, )",
           "Octokit": "[9.0.0, )",
           "Octokit.GraphQL": "[0.3.0-beta, )",
           "TQLApp.Utilities": "[0.0.0, )"
diff --git a/src/Tql.Plugins.GitHub/ConfigurationUI/DeviceCodeWindow.xaml b/src/Tql.Plugins.GitHub/ConfigurationUI/DeviceCodeWindow.xaml
deleted file mode 100644
index 8bfc17d1..00000000
--- a/src/Tql.Plugins.GitHub/ConfigurationUI/DeviceCodeWindow.xaml
+++ /dev/null
@@ -1,93 +0,0 @@
-<utilities:BaseWindow
-    x:Class="Tql.Plugins.GitHub.ConfigurationUI.DeviceCodeWindow"
-    x:ClassModifier="internal"
-    xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
-    xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
-    xmlns:d="http://schemas.microsoft.com/expression/blend/2008"
-    xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"
-    xmlns:app="clr-namespace:Tql.Plugins.GitHub"
-    xmlns:utilities="clr-namespace:Tql.Utilities;assembly=Tql.Utilities"
-    WindowStartupLocation="CenterOwner"
-    ResizeMode="NoResize"
-    mc:Ignorable="d"
-    Title="{x:Static app:Labels.DeviceCodeWindow_Title}"
-    Height="Auto"
-    Width="400"
-    SizeToContent="Height">
-    <Grid Margin="9">
-        <Grid.ColumnDefinitions>
-            <ColumnDefinition Width="Auto" />
-            <ColumnDefinition Width="*" />
-        </Grid.ColumnDefinitions>
-        <Grid.RowDefinitions>
-            <RowDefinition Height="Auto" />
-            <RowDefinition Height="Auto" />
-        </Grid.RowDefinitions>
-
-        <Image
-            x:Name="_logo"
-            Height="64"
-            Width="64"
-            Margin="0,0,10,0"
-            VerticalAlignment="Top" />
-
-        <StackPanel
-            Orientation="Vertical"
-            Grid.Column="1">
-            <TextBlock
-                Margin="3"
-                FontWeight="Bold"
-                TextWrapping="Wrap"
-                Text="{x:Static app:Labels.DeviceCodeWindow_AuthenticationWithGitHub}" />
-            <TextBlock
-                Margin="3"
-                TextWrapping="Wrap"
-                Text="{x:Static app:Labels.DeviceCodeWindow_HelpText}" />
-        </StackPanel>
-
-        <StackPanel
-            Grid.Row="1"
-            Grid.ColumnSpan="2">
-            <Grid VerticalAlignment="Center">
-                <Grid.ColumnDefinitions>
-                    <ColumnDefinition Width="*" />
-                    <ColumnDefinition Width="Auto" />
-                    <ColumnDefinition Width="Auto" />
-                    <ColumnDefinition Width="*" />
-                </Grid.ColumnDefinitions>
-
-                <TextBox
-                    x:Name="_userCode"
-                    Grid.Column="1"
-                    Margin="3"
-                    Width="110"
-                    IsReadOnly="True"
-                    FontSize="13pt"
-                    FontWeight="Bold"
-                    TextAlignment="Center" />
-
-                <Button
-                    x:Name="_copy"
-                    Margin="3"
-                    Grid.Column="2"
-                    Height="22"
-                    Width="22"
-                    Padding="0"
-                    Click="_copy_Click">
-                    <Image
-                        x:Name="_copyImage"
-                        Height="14"
-                        Width="14" />
-                </Button>
-            </Grid>
-
-            <Button
-                x:Name="_openPage"
-                Margin="3"
-                VerticalAlignment="Center"
-                Width="200"
-                Click="_openPage_Click"
-                Content="{x:Static app:Labels.DeviceCodeWindow_OpenDeviceActivationPage}" />
-        </StackPanel>
-    </Grid>
-</utilities:BaseWindow>
diff --git a/src/Tql.Plugins.GitHub/ConfigurationUI/DeviceCodeWindow.xaml.cs b/src/Tql.Plugins.GitHub/ConfigurationUI/DeviceCodeWindow.xaml.cs
deleted file mode 100644
index 7adb5c9a..00000000
--- a/src/Tql.Plugins.GitHub/ConfigurationUI/DeviceCodeWindow.xaml.cs
+++ /dev/null
@@ -1,129 +0,0 @@
-using System.Diagnostics;
-using System.Net.Http;
-using System.Net.Http.Headers;
-using System.Runtime.ExceptionServices;
-using System.Text.Json.Serialization;
-using System.Windows.Threading;
-using Tql.Abstractions;
-using Tql.Plugins.GitHub.Services;
-using Clipboard = System.Windows.Clipboard;
-
-namespace Tql.Plugins.GitHub.ConfigurationUI;
-
-internal partial class DeviceCodeWindow
-{
-    private readonly DeviceCodeLoginDto _loginDto;
-    private readonly string _clientId;
-    private readonly IUI _ui;
-    private readonly HttpClient _httpClient;
-    private readonly DispatcherTimer _timer;
-    private readonly Stopwatch _stopwatch = Stopwatch.StartNew();
-
-    public string? AccessToken { get; private set; }
-    public ExceptionDispatchInfo? Exception { get; private set; }
-
-    public DeviceCodeWindow(
-        DeviceCodeLoginDto loginDto,
-        string clientId,
-        IUI ui,
-        HttpClient httpClient
-    )
-    {
-        _loginDto = loginDto;
-        _clientId = clientId;
-        _ui = ui;
-        _httpClient = httpClient;
-
-        InitializeComponent();
-
-        _userCode.Text = loginDto.UserCode;
-        _logo.Source = Images.GitHub;
-        _copyImage.Source = Images.Copy;
-
-        _timer = new DispatcherTimer { Interval = TimeSpan.FromSeconds(loginDto.Interval) };
-        _timer.Tick += _timer_Tick;
-        _timer.Start();
-
-        Closed += (_, _) => _timer.Stop();
-    }
-
-    private async void _timer_Tick(object? sender, EventArgs e)
-    {
-        try
-        {
-            if (_stopwatch.Elapsed.TotalSeconds > _loginDto.ExpiresIn)
-                throw new GitHubAuthenticationException("User code expired");
-
-            // Grant type is taken from https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps#device-flow.
-
-            using var request = new HttpRequestMessage(
-                HttpMethod.Post,
-                "https://github.com/login/oauth/access_token"
-                    + $"?client_id={Uri.EscapeDataString(_clientId)}"
-                    + $"&device_code={Uri.EscapeDataString(_loginDto.DeviceCode)}"
-                    + $"&grant_type={Uri.EscapeDataString("urn:ietf:params:oauth:grant-type:device_code")}"
-            );
-
-            request.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
-
-            using var response = await _httpClient.SendAsync(request);
-
-            response.EnsureSuccessStatusCode();
-
-            using var stream = await response.Content.ReadAsStreamAsync();
-
-            var dto = JsonSerializer.Deserialize<AccessTokenDto>(stream)!;
-
-            if (dto.Error == "authorization_pending")
-                return;
-
-            if (dto.Error == "slow_down")
-            {
-                _timer.Stop();
-                _timer.Interval = TimeSpan.FromSeconds(dto.Interval!.Value);
-                _timer.Start();
-                return;
-            }
-
-            if (dto.Error != null)
-                throw new GitHubAuthenticationException(dto.ErrorDescription ?? dto.Error);
-
-            if (dto.TokenType != "bearer")
-            {
-                throw new GitHubAuthenticationException(
-                    $"Did not expect token type '{dto.TokenType}'"
-                );
-            }
-
-            AccessToken = dto.AccessToken;
-
-            DialogResult = true;
-            Close();
-        }
-        catch (Exception ex)
-        {
-            Exception = ExceptionDispatchInfo.Capture(ex);
-            Close();
-        }
-    }
-
-    private void _openPage_Click(object? sender, RoutedEventArgs e)
-    {
-        _ui.OpenUrl(_loginDto.VerificationUri);
-    }
-
-    private void _copy_Click(object? sender, RoutedEventArgs e)
-    {
-        Clipboard.SetText(_userCode.Text);
-    }
-
-    private record AccessTokenDto(
-        [property: JsonPropertyName("access_token")] string? AccessToken,
-        [property: JsonPropertyName("token_type")] string? TokenType,
-        [property: JsonPropertyName("scope")] string? Scope,
-        [property: JsonPropertyName("error")] string? Error,
-        [property: JsonPropertyName("error_description")] string? ErrorDescription,
-        [property: JsonPropertyName("error_uri")] string? ErrorUri,
-        [property: JsonPropertyName("interval")] int? Interval
-    );
-}
diff --git a/src/Tql.Plugins.GitHub/Constants.cs b/src/Tql.Plugins.GitHub/Constants.cs
new file mode 100644
index 00000000..7f9e31da
--- /dev/null
+++ b/src/Tql.Plugins.GitHub/Constants.cs
@@ -0,0 +1,6 @@
+namespace Tql.Plugins.GitHub;
+
+internal static class Constants
+{
+    public static readonly TimeSpan AuthenticationTimeout = TimeSpan.FromMinutes(5);
+}
diff --git a/src/Tql.Plugins.GitHub/Labels.Designer.cs b/src/Tql.Plugins.GitHub/Labels.Designer.cs
index 7ec38f00..246a562e 100644
--- a/src/Tql.Plugins.GitHub/Labels.Designer.cs
+++ b/src/Tql.Plugins.GitHub/Labels.Designer.cs
@@ -159,42 +159,6 @@ public static string ConnectionEditWindow_Title {
             }
         }
         
-        /// <summary>
-        ///   Looks up a localized string similar to Authenticate with GitHub.
-        /// </summary>
-        public static string DeviceCodeWindow_AuthenticationWithGitHub {
-            get {
-                return ResourceManager.GetString("DeviceCodeWindow_AuthenticationWithGitHub", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to Click the button below to go to the GitHub website and enter the user code shown below:.
-        /// </summary>
-        public static string DeviceCodeWindow_HelpText {
-            get {
-                return ResourceManager.GetString("DeviceCodeWindow_HelpText", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to Open Device Activation page.
-        /// </summary>
-        public static string DeviceCodeWindow_OpenDeviceActivationPage {
-            get {
-                return ResourceManager.GetString("DeviceCodeWindow_OpenDeviceActivationPage", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to GitHub Authentication.
-        /// </summary>
-        public static string DeviceCodeWindow_Title {
-            get {
-                return ResourceManager.GetString("DeviceCodeWindow_Title", resourceCulture);
-            }
-        }
-        
         /// <summary>
         ///   Looks up a localized string similar to GitHub Gist.
         /// </summary>
@@ -240,6 +204,15 @@ public static string GitHubApi_UnableToConnect {
             }
         }
         
+        /// <summary>
+        ///   Looks up a localized string similar to Authentication completed. You can now go back to the app..
+        /// </summary>
+        public static string GitHubOAuthWorkflow_AuthenticationComplete {
+            get {
+                return ResourceManager.GetString("GitHubOAuthWorkflow_AuthenticationComplete", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   Looks up a localized string similar to GitHub.
         /// </summary>
diff --git a/src/Tql.Plugins.GitHub/Labels.nl.resx b/src/Tql.Plugins.GitHub/Labels.nl.resx
index 24bd803b..882356c2 100644
--- a/src/Tql.Plugins.GitHub/Labels.nl.resx
+++ b/src/Tql.Plugins.GitHub/Labels.nl.resx
@@ -82,22 +82,6 @@
     <value>Naam:</value>
     <comment>Original: Name:</comment>
   </data>
-  <data name="DeviceCodeWindow_AuthenticationWithGitHub" xml:space="preserve">
-    <value>Authentiseer met GitHub</value>
-    <comment>Original: Authenticate with GitHub</comment>
-  </data>
-  <data name="DeviceCodeWindow_HelpText" xml:space="preserve">
-    <value>Klik op de knop hieronder om naar de GitHub website te gaan en voor deze gebruikers code in:</value>
-    <comment>Original: Click the button below to go to the GitHub website and enter the user code shown below:</comment>
-  </data>
-  <data name="DeviceCodeWindow_OpenDeviceActivationPage" xml:space="preserve">
-    <value>Open Apparaat Activatie pagina</value>
-    <comment>Original: Open Device Activation page</comment>
-  </data>
-  <data name="DeviceCodeWindow_Title" xml:space="preserve">
-    <value>GitHub Authenticatie</value>
-    <comment>Original: GitHub Authentication</comment>
-  </data>
   <data name="GistsMatch_SearchHint" xml:space="preserve">
     <value>Vind gists</value>
     <comment>Original: Find gists</comment>
@@ -254,4 +238,8 @@
     <value>Vind workflow runs</value>
     <comment>Original: Find workflow runs</comment>
   </data>
+  <data name="GitHubOAuthWorkflow_AuthenticationComplete" xml:space="preserve">
+    <value>Authenticatie is afgerond. Je kunt nu terug naar de app.</value>
+    <comment>Original: Authentication completed. You can now go back to the app.</comment>
+  </data>
 </root>
\ No newline at end of file
diff --git a/src/Tql.Plugins.GitHub/Labels.resx b/src/Tql.Plugins.GitHub/Labels.resx
index 23ca045f..617db47f 100644
--- a/src/Tql.Plugins.GitHub/Labels.resx
+++ b/src/Tql.Plugins.GitHub/Labels.resx
@@ -135,18 +135,6 @@
   <data name="ConnectionEditWindow_NameLabel" xml:space="preserve">
     <value>Name:</value>
   </data>
-  <data name="DeviceCodeWindow_AuthenticationWithGitHub" xml:space="preserve">
-    <value>Authenticate with GitHub</value>
-  </data>
-  <data name="DeviceCodeWindow_HelpText" xml:space="preserve">
-    <value>Click the button below to go to the GitHub website and enter the user code shown below:</value>
-  </data>
-  <data name="DeviceCodeWindow_OpenDeviceActivationPage" xml:space="preserve">
-    <value>Open Device Activation page</value>
-  </data>
-  <data name="DeviceCodeWindow_Title" xml:space="preserve">
-    <value>GitHub Authentication</value>
-  </data>
   <data name="GistsMatch_SearchHint" xml:space="preserve">
     <value>Find gists</value>
   </data>
@@ -264,4 +252,7 @@
   <data name="WorkflowRunsMatch_SearchHint" xml:space="preserve">
     <value>Find workflow runs</value>
   </data>
+  <data name="GitHubOAuthWorkflow_AuthenticationComplete" xml:space="preserve">
+    <value>Authentication completed. You can now go back to the app.</value>
+  </data>
 </root>
\ No newline at end of file
diff --git a/src/Tql.Plugins.GitHub/Services/GitHubApi.cs b/src/Tql.Plugins.GitHub/Services/GitHubApi.cs
index ce15bb65..b2bf4e30 100644
--- a/src/Tql.Plugins.GitHub/Services/GitHubApi.cs
+++ b/src/Tql.Plugins.GitHub/Services/GitHubApi.cs
@@ -1,11 +1,7 @@
-using System.Net.Http;
-using System.Net.Http.Headers;
-using System.Text.Json.Serialization;
-using System.Windows.Interop;
+using System.Text.Json.Serialization;
 using Microsoft.Extensions.Logging;
 using Octokit;
 using Tql.Abstractions;
-using Tql.Plugins.GitHub.ConfigurationUI;
 using Tql.Utilities;
 using GraphQLConnection = Octokit.GraphQL.Connection;
 using IWin32Window = System.Windows.Forms.IWin32Window;
@@ -17,17 +13,28 @@ internal class GitHubApi(
     ILogger<GitHubApi> logger,
     IUI ui,
     ConfigurationManager configurationManager,
-    HttpClient httpClient,
     IEncryption encryption
 )
 {
     private const string ClientId = "b5cf8dfb10c01dcfd22f";
     private const string Scope = "repo,project,read:org";
+    private const string RedirectUri = "http://127.0.0.1:23119/";
 
     private readonly AsyncLock _lock = new();
     private readonly Dictionary<Guid, GitHubClient> _clients = new();
     private readonly Dictionary<Guid, GraphQLConnection> _connections = new();
 
+    private static string GetClientSecret()
+    {
+#if DEBUG
+        return Environment.GetEnvironmentVariable("GITHUB_OAUTH_SECRET")!;
+#else
+        return Encoding
+            .UTF8
+            .GetString(Convert.FromBase64String("""<![SECRET[GITHUB_OAUTH_SECRET]]>"""));
+#endif
+    }
+
     public async Task<GitHubClient> GetClient(Guid id)
     {
         using (await _lock.LockAsync())
@@ -140,8 +147,8 @@ await ui.PerformInteractiveAuthentication(
                 new InteractiveAuthentication(
                     string.Format(Labels.GitHubApi_ResourceName, connection.Name),
                     client,
-                    httpClient,
-                    ui
+                    ui,
+                    logger
                 )
             );
 
@@ -186,42 +193,24 @@ private void WriteCredentials(Guid id, CredentialsDto credentialsDto)
     private class InteractiveAuthentication(
         string resourceName,
         GitHubClient client,
-        HttpClient httpClient,
-        IUI ui
+        IUI ui,
+        ILogger logger
     ) : IInteractiveAuthentication
     {
         public string ResourceName { get; } = resourceName;
 
         public async Task Authenticate(IWin32Window owner)
         {
-            using var request = new HttpRequestMessage(
-                HttpMethod.Post,
-                $"https://github.com/login/device/code?client_id={Uri.EscapeDataString(ClientId)}&scope={Uri.EscapeDataString(Scope)}"
+            var workflow = new GitHubOAuthWorkflow(
+                ClientId,
+                GetClientSecret(),
+                Scope,
+                RedirectUri,
+                ui,
+                logger
             );
 
-            request.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
-
-            using var response = await httpClient.SendAsync(request);
-
-            response.EnsureSuccessStatusCode();
-
-            using var stream = await response.Content.ReadAsStreamAsync();
-
-            var dto = JsonSerializer.Deserialize<DeviceCodeLoginDto>(stream)!;
-
-            var window = new DeviceCodeWindow(dto, ClientId, ui, httpClient)
-            {
-                Owner = HwndSource.FromHwnd(owner.Handle)?.RootVisual as Window
-            };
-
-            window.ShowDialog();
-
-            window.Exception?.Throw();
-
-            if (window.AccessToken == null)
-                throw new GitHubAuthenticationException("Unexpected error");
-
-            client.Credentials = new Credentials(window.AccessToken, AuthenticationType.Bearer);
+            client.Credentials = await workflow.Authorize();
 
             await client.User.Current();
         }
@@ -229,11 +218,3 @@ public async Task Authenticate(IWin32Window owner)
 
     private record CredentialsDto(string AccessToken, string Scope);
 }
-
-internal record DeviceCodeLoginDto(
-    [property: JsonPropertyName("device_code")] string DeviceCode,
-    [property: JsonPropertyName("user_code")] string UserCode,
-    [property: JsonPropertyName("verification_uri")] string VerificationUri,
-    [property: JsonPropertyName("expires_in")] int ExpiresIn,
-    [property: JsonPropertyName("interval")] int Interval
-);
diff --git a/src/Tql.Plugins.GitHub/Services/GitHubOAuthException.cs b/src/Tql.Plugins.GitHub/Services/GitHubOAuthException.cs
new file mode 100644
index 00000000..3ec16bc3
--- /dev/null
+++ b/src/Tql.Plugins.GitHub/Services/GitHubOAuthException.cs
@@ -0,0 +1,12 @@
+namespace Tql.Plugins.GitHub.Services;
+
+internal class GitHubOAuthException : Exception
+{
+    public GitHubOAuthException() { }
+
+    public GitHubOAuthException(string? message)
+        : base(message) { }
+
+    public GitHubOAuthException(string? message, Exception? innerException)
+        : base(message, innerException) { }
+}
diff --git a/src/Tql.Plugins.GitHub/Services/GitHubOAuthWorkflow.cs b/src/Tql.Plugins.GitHub/Services/GitHubOAuthWorkflow.cs
new file mode 100644
index 00000000..52be30f3
--- /dev/null
+++ b/src/Tql.Plugins.GitHub/Services/GitHubOAuthWorkflow.cs
@@ -0,0 +1,50 @@
+using System.Collections.Specialized;
+using Microsoft.Extensions.Logging;
+using OAuth2.Configuration;
+using OAuth2.Infrastructure;
+using Octokit;
+using Tql.Abstractions;
+using GitHubClient = OAuth2.Client.Impl.GitHubClient;
+
+namespace Tql.Plugins.GitHub.Services;
+
+internal class GitHubOAuthWorkflow(
+    string clientId,
+    string clientSecret,
+    string scope,
+    string redirectUri,
+    IUI ui,
+    ILogger logger
+)
+{
+    public async Task<Credentials> Authorize()
+    {
+        var client = new GitHubClient(
+            new RequestFactory(),
+            new ClientConfiguration
+            {
+                ClientId = clientId,
+                ClientSecret = clientSecret,
+                Scope = scope,
+                RedirectUri = redirectUri
+            }
+        );
+
+        logger.LogInformation("Redirect URI {RedirectURI}", redirectUri);
+
+        NameValueCollection queryString;
+
+        using (var httpServer = new SimpleHttpServer(redirectUri, logger))
+        {
+            var authorizationRequest = await client.GetLoginLinkUriAsync();
+
+            ui.OpenUrl(authorizationRequest);
+
+            queryString = await httpServer.GetResponse(Constants.AuthenticationTimeout);
+        }
+
+        var accessToken = await client.GetTokenAsync(queryString);
+
+        return new Credentials(accessToken, AuthenticationType.Bearer);
+    }
+}
diff --git a/src/Tql.Plugins.GitHub/Services/SimpleHttpServer.cs b/src/Tql.Plugins.GitHub/Services/SimpleHttpServer.cs
new file mode 100644
index 00000000..05e67dd3
--- /dev/null
+++ b/src/Tql.Plugins.GitHub/Services/SimpleHttpServer.cs
@@ -0,0 +1,57 @@
+using System.Collections.Specialized;
+using System.Net;
+using System.Security;
+using Microsoft.Extensions.Logging;
+
+namespace Tql.Plugins.GitHub.Services;
+
+internal class SimpleHttpServer : IDisposable
+{
+    private readonly ILogger _logger;
+    private readonly HttpListener _http;
+
+    public SimpleHttpServer(string prefix, ILogger logger)
+    {
+        _logger = logger;
+        _http = new HttpListener();
+
+        _http.Prefixes.Add(prefix);
+
+        logger.LogInformation("Listing for incoming requests");
+
+        _http.Start();
+    }
+
+    public async Task<NameValueCollection> GetResponse(TimeSpan timeout)
+    {
+        var contextTask = _http.GetContextAsync();
+
+        if (await Task.WhenAny(contextTask, Task.Delay(timeout)) != contextTask)
+            throw new GitHubOAuthException("Authentication timed out");
+
+        var context = await contextTask;
+
+        var buffer = Encoding
+            .UTF8
+            .GetBytes(
+                $"<html><body>{SecurityElement.Escape(Labels.GitHubOAuthWorkflow_AuthenticationComplete)}</body></html>"
+            );
+
+        context.Response.ContentLength64 = buffer.Length;
+
+        await using var responseOutput = context.Response.OutputStream;
+
+        await responseOutput.WriteAsync(buffer, 0, buffer.Length);
+
+        return context.Request.QueryString;
+    }
+
+    public void Dispose()
+    {
+        _http.Stop();
+
+        _logger.LogInformation("HTTP server stopped");
+
+        ((IDisposable)_http).Dispose();
+    }
+}
diff --git a/src/Tql.Plugins.GitHub/Tql.Plugins.GitHub.csproj b/src/Tql.Plugins.GitHub/Tql.Plugins.GitHub.csproj
index fe456709..67ff75ce 100644
--- a/src/Tql.Plugins.GitHub/Tql.Plugins.GitHub.csproj
+++ b/src/Tql.Plugins.GitHub/Tql.Plugins.GitHub.csproj
@@ -17,6 +17,7 @@
 
 	<ItemGroup>
 		<PackageReference Include="HtmlAgilityPack" Version="1.11.54" />
+		<PackageReference Include="OAuth2" Version="0.10.3" />
 		<PackageReference Include="Octokit" Version="9.0.0" />
 		<PackageReference Include="Octokit.GraphQL" Version="0.3.0-beta" />
 	</ItemGroup>
diff --git a/src/Tql.Plugins.GitHub/packages.lock.json b/src/Tql.Plugins.GitHub/packages.lock.json
index 61990644..1e538157 100644
--- a/src/Tql.Plugins.GitHub/packages.lock.json
+++ b/src/Tql.Plugins.GitHub/packages.lock.json
@@ -8,6 +8,16 @@
         "resolved": "1.11.54",
         "contentHash": "bgB79N4urc4D7hrD4R+Qk6CjPiYOfs6vfXNsmw3nCcfQEQvBQGjfAcl5k/tB1ZP1hA0d7xXs0jK8xAXV36IVUg=="
       },
+      "OAuth2": {
+        "type": "Direct",
+        "requested": "[0.10.3, )",
+        "resolved": "0.10.3",
+        "contentHash": "Yg5OaNfNrUq2HN0LNcxGL9plMh3XC9fja1/iTVZB96D7UwIxk0iq9irN0EbvardXlALUIIv3NKz6CVRHk+1Mxg==",
+        "dependencies": {
+          "Newtonsoft.Json": "13.0.2",
+          "RestSharp": "106.12.0"
+        }
+      },
       "Octokit": {
         "type": "Direct",
         "requested": "[9.0.0, )",
@@ -95,8 +105,13 @@
       },
       "Newtonsoft.Json": {
         "type": "Transitive",
-        "resolved": "13.0.1",
-        "contentHash": "ppPFpBcvxdsfUonNcvITKqLl3bqxWbDCZIzDWHzjpdAHRFfZe0Dw9HmA0+za13IdyrgJwpkDTDA9fHaxOrt20A=="
+        "resolved": "13.0.2",
+        "contentHash": "R2pZ3B0UjeyHShm9vG+Tu0EBb2lC8b0dFzV9gVn50ofHXh9Smjk6kTn7A/FdAsC8B5cKib1OnGYOXxRBz5XQDg=="
+      },
+      "RestSharp": {
+        "type": "Transitive",
+        "resolved": "106.12.0",
+        "contentHash": "irOsQHe5nTJB0BKxGQnTX1dsgCPl5dLTxvL7gbl98JiFPiHMN4wpFyUG/66ZpaFCsIrPKh6XwozWXlwYe9JwYQ=="
       },
       "SharpVectors.Wpf": {
         "type": "Transitive",
diff --git a/tests/Tql.Plugins.GitHub.Test/packages.lock.json b/tests/Tql.Plugins.GitHub.Test/packages.lock.json
index 746cde43..40095ba2 100644
--- a/tests/Tql.Plugins.GitHub.Test/packages.lock.json
+++ b/tests/Tql.Plugins.GitHub.Test/packages.lock.json
@@ -557,6 +557,15 @@
           "NETStandard.Library": "2.0.0"
         }
       },
+      "OAuth2": {
+        "type": "Transitive",
+        "resolved": "0.10.3",
+        "contentHash": "Yg5OaNfNrUq2HN0LNcxGL9plMh3XC9fja1/iTVZB96D7UwIxk0iq9irN0EbvardXlALUIIv3NKz6CVRHk+1Mxg==",
+        "dependencies": {
+          "Newtonsoft.Json": "13.0.2",
+          "RestSharp": "106.12.0"
+        }
+      },
       "Octokit": {
         "type": "Transitive",
         "resolved": "9.0.0",
@@ -570,6 +579,11 @@
           "Newtonsoft.Json": "13.0.1"
         }
       },
+      "RestSharp": {
+        "type": "Transitive",
+        "resolved": "106.12.0",
+        "contentHash": "irOsQHe5nTJB0BKxGQnTX1dsgCPl5dLTxvL7gbl98JiFPiHMN4wpFyUG/66ZpaFCsIrPKh6XwozWXlwYe9JwYQ=="
+      },
       "SharpVectors.Wpf": {
         "type": "Transitive",
         "resolved": "1.8.2",
@@ -1000,6 +1014,7 @@
         "type": "Project",
         "dependencies": {
           "HtmlAgilityPack": "[1.11.54, )",
+          "OAuth2": "[0.10.3, )",
           "Octokit": "[9.0.0, )",
           "Octokit.GraphQL": "[0.3.0-beta, )",
           "TQLApp.Utilities": "[0.0.0, )"