App manifest flow: state parameter ignored

According to it is possible to include a state parameter as well as a manifest parameter. (For my purposes this is necessary to provide some information to the callback; it is not merely a question of security.) So I tried something like

<form action="" method="post">
    <input type="hidden" name="manifest" value="{&quot;name&quot;:&quot;suggested-name&quot;,…}"/>
    <input type="hidden" name="state" value="{s3cr3t}"/>
<input type="submit" value="Submit"/>

The flow worked insofar as the prompt to create the app was displayed and my redirect_url was notified with a code query parameter. But no state query parameter was sent as promises. Am I missing something?

As a workaround, I tried encoding state information in a query parameter in my redirect_url. This was rejected by GitHub with an error to the effect that this was an invalid URL. (It was a valid URL generally, but apparently not valid for this purpose.) What finally worked was to encode the state in a path segment in my redirect_url.

I have a similar problem. My manifest parameter gets ignored for some reason. I use exactly the same HTML form as you do, but when I get redirected to Github I don’t see any values pre-filled. I opened another issue about this here: then I found yours.

This is my manifest:

  "name": "",
  "url": "",
  "hook_attributes": {
    "url": "",
    "active": true
  "redirect_url": "",
  "public": false,
  "default_permissions": {
    "contents": "write",
    "metadata": "read-only"
  "default_events": [

Do you know what I am doing wrong?

@whymatter that is an unrelated issue.

I have the EXACT same problem! Uhg.

Very unfortunate this thread has been ignored by GitHub :frowning: This is a vital piece of functionality for passing state between the Manifest creation and the callback.

Adding the “state” information to the redirect_url query path was a clever trick and will work for me as well. Thanks @jglick!

It’s confusing the documentation is wrong about this. It’s not even clear if this is still supposed to work or if this functionality has been abandoned, or maybe not yet implemented?