[throwanem]

You could keep a fine-grained token in local storage, maybe. Bit of a headache for multiple device/browser use, but I guess that's the tradeoff - lose adoption to mistrust due to Github making you request overbroad permissions with a classic token, or lose adoption to friction due to Github not yet making fine-grained tokens available in their OAuth grant flow.

It might get easier once fine-grained tokens leave beta. I don't know if OAuth support is on the roadmap for that, but it seems like a natural enough fit I'd be astonished if it weren't.