Up and running in a minute.
Pyor talks straight to GitHub from your machine; our backend handles only sign-in, billing, and team seats, and never touches your code. Setup is one thing: sign in with GitHub so Pyor can read your reviews on your behalf. Here’s how, and exactly why each part is needed.
Sign in with GitHub.
On first launch, click Sign in with GitHub. Pyor sends you to GitHub to authorize the app, then hands you straight back — on desktop through a secure pyor:// deep link, on the web through a normal redirect.
GitHub shows you exactly what you’re granting. Pyor asks only for the read access it needs to show your reviews and to post on your behalf — nothing more — and you can revoke it from your GitHub settings at any time.
Reviewing an organization’s PRs.
Your personal repositories work the moment you sign in. To review an organization’s pull requests, the Pyor app has to be installed on that org — an org owner does this once from GitHub’s install screen. How organizations work →
If your org enforces SAML single sign-on, authorize Pyor for it when GitHub prompts you during sign-in — the org’s PRs show up the next time Pyor refreshes.
No SSO at your org? There’s nothing to do here.
Your access stays on your machine.
When you authorize, GitHub issues a short-lived access token. Pyor stores it locally, on your side of the wire:
- On the desktop app — in your operating system’s keychain (macOS Keychain, Windows DPAPI, or Linux libsecret), under the bundle
com.pyor.app. - On the web build — in your browser’s
localStorage.
Our backend brokers the sign-in and refreshes the token when it expires, but never stores it and never sees your code — your diffs and pull requests always flow directly between your machine and GitHub.
Why sign in with GitHub?
Signing in through GitHub gives you access scoped to exactly what Pyor needs and that expires on its own — safer than a long-lived token you mint by hand and forget about. You can see and revoke it from your GitHub settings in one click.
It also lets our backend broker billing and your team’s seats. That backend never stores your token and never receives your code — your repositories, diffs, and pull requests go straight from your machine to GitHub, with nothing of yours in the middle.
Signed out unexpectedly? (401)
If GitHub starts returning 401 — usually because your access was revoked or its SSO authorization lapsed — Pyor doesn’t fail silently. It switches to a read-only state over your cached data and shows a “Sign in again” affordance.
Two things to check, in order:
- Sign in with GitHub again via “Sign in again” to refresh your access.
- Re-check SSO authorization — if an org rotated its SAML config, re-authorize Pyor when GitHub prompts you on the next sign-in.
Still stuck after signing in again? support@pyor.review — the diagnostic surface in-app shows the last successful call and the failing endpoint, which is the fastest thing to send us.
That’s the whole setup.
Don’t have the app yet, or want to understand the privacy model in full first?