For MSPs: one GitHub App for every client

If you manage several clients, you don't need a personal access token per client. Connect your own GitHub App to Waxell once, then assign each client workspace its marketplace repository. Waxell signs in as the app and, on every sync, gets a short-lived credential that can reach only that client's repository.

• Access isn't tied to anyone's GitHub account.
• Your clients never need GitHub accounts — the repositories live in your GitHub, under your sign-in and provisioning.
• You assign repositories; a client workspace sees Managed by your partner name and can't point at another repository.

Which GitHub do you have?

The Waxell side works the same everywhere. What changes is how each client's claude.ai reaches its repository, and that decides the layout.

You sign in at	It is	claude.ai connects through	Client isolation needs
github.com (with or without an Enterprise plan)	GitHub, or GitHub Enterprise Cloud	Git providers → GitHub (Anthropic's Claude app)	One organization per client
yourco.ghe.com	GitHub Enterprise Cloud with data residency	Git providers → GitHub Enterprise (your own app)	One organization, one app per client
Your own server, e.g. github.yourco.com	GitHub Enterprise Server	Git providers → GitHub Enterprise (your own app)	One organization, one app per client

An Enterprise Cloud account on github.com is still github.com

claude.ai's GitHub Enterprise connection accepts only a separate host. It refuses github.com ("not a GitHub Enterprise instance"), so on github.com you can't bring your own app — use the GitHub connection and the organization-per-client layout.

Layout on github.com: one organization per client

claude.ai connects through Anthropic's Claude GitHub App, and GitHub allows one installation of an app per organization, with one repository list. Two clients whose repositories share an organization would share that list. So give each client its own organization:

Your main organization	Owns your Waxell GitHub App. Holds no client repositories.
One organization per client, e.g. yourco-acme	Holds only that client's marketplace repository. Your Waxell app and the Claude app are both installed here, each with access to only that repository.

Free organizations work for this. Invite each one into your enterprise to keep central control (your owners on every organization, one bill, SSO later). Your Waxell app must then be installable on Any account (step 1).

Layout on GHE.com or Enterprise Server: one app per client

Here each client's claude.ai takes your own GitHub App, so the isolation is the app's repository access, not the organization boundary:

One organization (yours)	Holds one repository per client: acme-marketplace, globex-marketplace, …
Your Waxell app (Contents: Read and write)	Installed once on the organization, with access to every marketplace repository. Waxell narrows each sync's credential to the one assigned repository.
One Claude app per client (Contents: Read-only)	e.g. Claude – Acme, installed with access to only acme-marketplace. Its details go into that client's claude.ai and nowhere else.

A client's claude.ai can then only ever see its own repository. Your clients never need GitHub accounts, and Enterprise Managed Users stays in charge.

Step 1 — Create the GitHub App

Create it under an organization you own — not your personal account, or the app (and Waxell's access) would belong to you as a person:

Your organization → Settings → Developer settings → GitHub Apps → New GitHub App (https://github.com/organizations/<your-org>/settings/apps/new; on GHE.com, https://<yourco>.ghe.com/organizations/<your-org>/settings/apps/new).

Field	Set to
GitHub App name	Anything, e.g. YourCo Waxell Marketplaces
Homepage URL	Your website
Webhook	Turn Active off
Repository permissions → Contents	Read and write
Repository permissions → Metadata	Read-only (GitHub sets this)
Where can this GitHub App be installed?	Any account for the organization-per-client layout (github.com); Only on this account when every client repository lives in your one organization (GHE.com / Enterprise Server)

Leave every other permission at No access, then Create GitHub App.

On the app's page, note the App ID near the top. Scroll to Private keys and click Generate a private key — a .pem file downloads. Treat it like a password: it goes into Waxell in the next step and nowhere else.

Step 2 — Connect it in Waxell

In your partner portal, switch to Operations at the top and click Claude marketplaces (or go to /msp/claude-marketplaces).

1. GitHub host: github.com, your GHE.com host (yourco.ghe.com) or your Enterprise Server host.
2. App ID and Private key: from step 1.
3. Click Connect app.

Waxell proves the App ID and key belong together before saving. The key is stored encrypted with your partner workspace's own key and never shown again — the page shows its fingerprint so you can match it to the key in GitHub.

Step 3 — Install it and assign repositories

For each client:

1. Create the client's repository (private, initialized with a README — Waxell needs a commit to build on).
2. Install the app with access to that repository. On the Claude marketplaces page click Install on another organization (or, in GitHub, the app's Install App tab), pick the organization, choose Only select repositories and select the repository. For a client whose repository is in an organization the app is already installed on, add the repository to that installation instead: Organization → Settings → GitHub Apps → the app → Configure → Repository access.
3. Back in Waxell, click Refresh. On the client's row click Assign, pick the installation (shown by organization name) and the repository, then Assign.

Waxell checks it can push before saving, then makes the first commit. From then on every approval or revoke in that client's workspace is committed within seconds.

Step 4 — Connect each client's claude.ai

A claude.ai connection belongs to one claude.ai organization, so this is done in each client's claude.ai, by one of its Owners.

On github.com

Follow Connect it in claude.ai in the client's claude.ai: install the Claude GitHub App on the client's organization with access to only its marketplace repository, then Add marketplace → Sync from GitHub.

On GHE.com or Enterprise Server

1. In your GitHub, create the client's Claude app under your organization (Settings → Developer settings → GitHub Apps → New GitHub App):

   Field	Set to
   GitHub App name	e.g. Claude – Acme
   Callback URL	https://claude.ai/connect/github/callback
   Webhook	Active, URL https://claude.ai, and a Secret of 20+ characters (keep it)
   Repository permissions → Contents	Read-only
   Where can this GitHub App be installed?	Only on this account

   Then Generate a private key, Generate a new client secret (copy it straight away — GitHub shows it once), and Install App on your organization with Only select repositories → the client's repository.

2. In the client's claude.ai: Admin settings → Git providers → GitHub Enterprise → Connect → Add manually. Enter your hostname (e.g. yourco.ghe.com), the App ID, client ID, client secret, webhook secret and private key, then Add configuration.

3. Admin settings → Plugins & skills → Add → Add marketplace → Sync from GitHub Enterprise, pick the client's repository, and turn on Sync automatically.

Keep claude.ai's access narrow

Whatever claude.ai connects with should reach only that client's repository. Never give one client's claude.ai a connection that can see other clients' repositories.

Manage it

Where	Control	Does
Claude marketplaces	Change	Point a client at a different repository.
Claude marketplaces	Unassign	Stop writing to that client's repository. It's left as it is.
Claude marketplaces	Replace key	Rotate the app's private key (generate a new one in GitHub first).
Claude marketplaces	Disconnect	Remove the app. Every assigned client's sync stops and says why.
Client workspace	Sync now, Pause / Resume	Still available to the client's admins.

Every connect, assignment and change is recorded in both your audit log and the client's.