docs: give the command that produces the single-line private key

[carolinaroncaglia]

Summary

The GitHub App walkthrough tells the reader to paste the private key into GitHub App private key (PEM) with every line break replaced by a literal \n (docs/connector.mdx:306), but does not say how to produce that value. This adds the command, and names the error a reader hits without it.

Findings addressed

The instruction had no way to satisfy it — measured.
Pasting the .pem unchanged does not work, and the reason is not guessable from the failure: measured on 2026-09-01 in Chromium 150 against the live field, a multi-line PEM pasted from the clipboard arrives on one line with each line break replaced by a space, character count preserved. The connector normalizes escaped line breaks — \n, \r\n, and a lone \r (pkg/connector/connector.go:489) — but not whitespace and not armor position, so the space-joined value is refused with invalid private key PEM format. That message names neither the whitespace nor the escaping requirement.

The command is verified, not suggested — measured.
awk '{printf "%s\\n", $0}' your-private-key.pem produces 0 real newlines and a literal \n at every line break, including a trailing one after the END armor. That trailing escape is harmless: run against the connector at v0.4.2, the value reaches the ASN.1 stage rather than being rejected at the PEM block, which is what shows pem.Decode accepted it. The same shape, entered through the config form, produced a full hosted sync during validation of the current release.

Why it mattered

The escaped form is the field's contract, and the same contract baton-okta has. The page already stated it; what it left to the reader was the mechanical step, and the failure that follows getting it wrong points at neither the cause nor the fix.

Scope

One addition, under the existing bullet that states the requirement. No other section changed.

🤖 Generated with Claude Code

[linear-code]

CXP-1062

[github-actions]

Connector PR Review: docs: give the command that produces the single-line private key

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base dd986def5db7.
Review mode: full
View review run

Review Summary

Scanned the full PR diff for security and correctness: this is a documentation-only change adding six lines to docs/connector.mdx — a note that pasting an unmodified .pem fails with invalid private key PEM format, plus an awk one-liner that emits the escaped single-line form. No Go source, config, or dependency manifests changed. I verified the added command against the connector's actual unescaping logic (pkg/connector/connector.go:487-489): the printf format emits a literal backslash-n at each line break, which is exactly what the escapedLineBreaks replacer converts back to real newlines before pem.Decode, and the trailing escape after the END armor is harmless. The snippet is correctly indented as a continuation of the existing bullet, so the fenced block renders inside the step. No new issues found.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

[github-actions]

No blocking issues found.