could not change github_trigger's addr from localhost

[cqw-acq]

Self Checks

• This is only for bug report, if you would like to ask a question, please head to Discussions.
• I have searched for existing issues Dify issues & Dify Official Plugins, including closed ones.
• I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
• [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:）
• Please do not modify this template :) and fill in all the required fields.

Dify version

1.11.2

Plugin version

1.4.2

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

Install Dify with offical guild line, then install github_trigger, try to create a start with api.

✔️ Error log

req_id: 622a1fb2c3 PluginInvokeError: {"args":{},"error_type":"SubscriptionError","message":"Failed to create GitHub webhook: Resource not accessible by personal access token"}

[dosubot]

Hi @cqw-acq! I'm Dosu and I’m helping the dify-official-plugins team.

In Docker setups, using localhost for the github_trigger plugin's address won't work for external webhooks—GitHub can't reach services bound to localhost inside a container. The plugin doesn't provide a direct way to change this address, but you should expose your Dify instance on a public or LAN IP, or use host.docker.internal if your Docker environment supports it. Make sure your endpoint is reachable over HTTPS from GitHub's servers, not just from inside your Docker host.

For the "Resource not accessible by personal access token" error, double-check that your GitHub personal access token has the admin:repo_hook scope and that the user is an admin on the target repository. This permission is required for webhook creation to succeed. Using a PAT is currently the only supported authentication method for this integration—OAuth is not fully supported yet in Dify's backend for external plugins like github_trigger.

More details and troubleshooting steps are available in the plugin's README and related issues:

• Why localhost fails in Docker and how to use host.docker.internal or LAN IP
• Required GitHub token scopes and webhook setup
• PAT scope and admin requirements

If you update your Docker network config and token scopes as described, webhook creation should work as expected.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

  

[cqw-acq]

@dosu but how to change addr, plugin doesn't let me change it!

[dosubot]

The github_trigger plugin doesn't have an internal setting to change the address from 'localhost'. Instead, you need to set the environment variables PLUGIN_DAEMON_URL and ENDPOINT_URL_TEMPLATE in your .env file to your host's LAN IP or a Docker-accessible address (not 'localhost'). For example:

PLUGIN_DAEMON_URL=http://192.168.x.x:3330
ENDPOINT_URL_TEMPLATE=http://192.168.x.x:3330/e/{hook_id}

Replace 192.168.x.x with your actual host IP. After updating, restart your containers. If you're on Docker Desktop, you can also try host.docker.internal as the address. Make sure the chosen IP and port are accessible from outside the container and exposed in your Docker setup. More details and examples are in this thread: How to change plugin address from localhost.

If you need help finding your host IP or configuring Docker networking, let me know your OS and setup details!

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

  

[cqw-acq]

@dosu I changed both into my domain, but it is still not working

[dosubot]

If changing PLUGIN_DAEMON_URL and ENDPOINT_URL_TEMPLATE to your domain didn't work, here are the most common causes and fixes:

1. Make sure your domain is publicly accessible over HTTPS and has a valid SSL certificate—GitHub requires this for webhook delivery (the plugin always sets insecure_ssl to "0") source.
2. After updating those environment variables, you must restart all Dify services (including plugin daemons and NGINX) for the changes to take effect source.
3. If webhooks work when accessing your internal port (like 5001) but not through your domain, your NGINX config is likely outdated. Update docker/nginx/conf.d/default.conf.template to the latest version from the Dify repo and restart the NGINX container. This fixes routing issues that cause webhooks to fail or return 404 via your domain source.
4. Double-check that your GitHub personal access token has the admin:repo_hook scope and that the user is an admin on the repo—otherwise, webhook creation will fail source.

If you still have trouble, please share the exact error message or log you see after switching to your domain, and confirm whether your domain is reachable from the public internet (for example, try curl https://your-domain/e/{hook_id} from outside your network). This will help pinpoint where things are breaking.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

  

[cqw-acq]

@dosu it says api-1 | core.plugin.impl.exc.PluginInvokeError: req_id: 6197e909d2 PluginInvokeError: {"args":{},"error_type":"SubscriptionError","message":"Failed to create GitHub webhook: Resource not accessible by personal access token"}

[dosubot]

This error means GitHub is rejecting your personal access token (PAT) when the plugin tries to create the webhook. The most common causes are:

• The PAT does not have the required admin:repo_hook (Repository hooks: Read & Write) scope, or the user is not an admin on the target repo. Double-check the token’s scopes and that the user is an admin on the repository you’re targeting. If you’re using a fine-grained PAT, make sure it’s granted access to the specific repo and includes the “Repository hooks” permission set to Read & Write. See plugin requirements
• The PAT is expired, revoked, or restricted (for example, by organization SSO or third-party app restrictions). Try generating a new PAT and using it.
• Organization-level or repo-level restrictions (like SSO, branch protection, or required app approval) can block webhook creation even with a valid PAT.
• The GitHub user must be an admin on the repo, not just a collaborator.

Changing the plugin address to your domain is necessary for webhook delivery, but it does not affect PAT permissions. The error is coming directly from GitHub’s API and is surfaced by the plugin when the webhook creation fails. See code reference

If you’ve confirmed all the above and still get this error, try removing and re-adding the integration with a freshly generated PAT, and check for any org-level policies that might block third-party integrations.

If you want to rule out endpoint issues, you can also test your webhook endpoint’s public accessibility by running curl https://your-domain/e/{hook_id} from outside your network.

If you share your PAT scopes (redact the token itself), I can help confirm if they’re correct.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

  

[cqw-acq]

@dosu but im sure my token is correct, so the only thing is my addr, can you help me to change my addr?

[dosubot]

To change the github_trigger plugin's address from localhost to your domain, set both PLUGIN_DAEMON_URL and ENDPOINT_URL_TEMPLATE in your .env file to use your domain (not localhost), for example:

PLUGIN_DAEMON_URL=https://your-domain.com:3330
ENDPOINT_URL_TEMPLATE=https://your-domain.com:3330/e/{hook_id}

After updating these, restart all Dify-related Docker containers—including plugin daemons and NGINX—to apply the changes. If the plugin still uses localhost, double-check that the environment variables are set correctly inside the running containers and that your domain is publicly accessible over HTTPS (GitHub requires valid SSL) reference.

If you still see issues, check your NGINX config: outdated routing can cause webhook failures even if the domain is set correctly. Update docker/nginx/conf.d/default.conf.template to the latest version from the Dify repo and restart NGINX reference.

To confirm your endpoint is reachable, run curl https://your-domain.com/e/{hook_id} from outside your network. If you get a 404 or can't connect, the domain isn't routed to the plugin service correctly.

If the endpoint in the Dify UI or logs still shows localhost after all this, try removing and re-adding the plugin or integration to force the new address to be used.

Let me know if you need help checking your Docker or NGINX setup, or if you want to share your actual endpoint URL for more targeted troubleshooting.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}