Is there a Github API OAuth scope that allows you to check a user has access to a private repo *without* also granting access to repo code?

I'm building an OAuth app to work with Github. I need to know, via token scopes, whether an authenticated user has access to a repo (public or private) so that I can restrict access accordingly in my app.

I explicitly do not want access to repo code from my app because a) I want users and companies to have confidence to use it with private repos and b) the app doesn't need to know, so I'd like to keep it least-privilege.

I'm struggling to find an OAuth scope that will allow the app to query whether a user has access to a specific repo without also needing to ask my users to grant the app permission to access their code.

The nearest I've found is repo:status. However that requires me to guess a branch name, which is usually main or master, but there's no guarantee.

Is there a better way?

You may be able to accomplish this using the repo_deployment scope and the /repos/{owner}/{repo}/deployments endpoint. The list of deployments confirms access to the repository, and it does not require prior knowledge about the default branch.

If it is possible to use a GitHub App instead of an OAuth App — and you are only concerned about organization repositories — then you could request organization member and repository metadata permissions in order to use the /repos/{owner}/{repo}/collaborators/{username} endpoint to check if the user is a collaborator on the repository.