App manifest flow on GHE: “Your browser did something unexpected.”

I am following which works on to initiate creation of an app for an org. When I try the same flow on GHE, just with the URL substituted to include the GHE domain, I POST a JSON manifest to and the server responds

Your browser did something unexpected. Please contact us if the problem persists.

Note that a GET request to the same URL gives the expected form Register new GitHub App.

Is there some way to diagnose the issue? Is the problem really about “my browser”, or was there some incorrect data being uploaded? Does GHE (in this case 2.20.6) even support the app manifest flow? (This suggests that it does.)

Still have been unable to get app creation on the organization URL to work—still getting a 422 “Unprocessable Entity” error. I tried an analogous flow for a user account ( and that worked.

On another note, I retested the flow on and it failed because when I POSTed to the initial I got a 302 redirect to a login page, which then immediately redirected back to the app creation URL but as a GET, thus showing the full form and losing my manifest details. At first I thought this was because GitHub was asking for my password after a period of inactivity in user settings (“sudo” style), but this kept on happening. I tried the same flow with a different user account and it worked fine. Under what conditions might a …/settings/apps/new POST result in a 302?

Thanks for being here @jglick and our apologies for the delay. I think the best way to get you help would be via private support, there isn’t really a way to bypass authentication or a add header “Authorization” so that it can connect with server. If you haven’t already, please contact us at with the info so we can look into that further.

Update: the 302 also reported by @whymatter in Create GitHub App with Manifest stopped working seems to have been fixed; the 422 is still broken in current GHE releases but I was told it is slated to be fixed in an update.

Is there an ETA on the expected GHE patch for this?

I was told to just watch which I have been doing.

I can no longer reproduce the 422 after updating GHE to 2.21.2, though I can find no mention of this bug in release notes. The closest match would be in 2.21.0:

A race condition for refresh on the OAuth page could cause a redirect to be executed twice.