GitHub has introduced a public-preview feature that allows GitHub CLI users to switch from long-lived OAuth credentials to short-lived access tokens that refresh automatically.
The update is available in GitHub CLI v2.103.0 and is designed to reduce the time a stolen access token can remain usable without forcing users to sign in repeatedly.
Announced on October 21, 2026, the feature pairs an expiring access token with a rotating refresh token. Under GitHub’s OAuth token model, access tokens last eight hours, while refresh tokens remain valid for six months.
When the access token expires, GitHub CLI can obtain a replacement automatically using the refresh token, which is also rotated during the process.
Previously, GitHub CLI used a long-lived token by default. If an attacker obtained that credential, it could potentially provide continued access until the token was revoked.
The new option shortens the validity period of the access token, although it does not eliminate the risks associated with stolen refresh tokens or compromised accounts.
Users can enable the feature for an individual sign-in by running gh auth login --expiring. To make expiring credentials the preferred option for future sign-ins, they can run gh config set expiring_credentials enabled. The command gh auth status displays whether the credential supports refreshing and when the current access token expires.
The feature remains optional, so existing sign-ins continue using their current credentials unless users opt in. GitHub CLI also falls back to a non-expiring token when the server does not support refreshable credentials.
Developers who use Git over HTTPS are advised to configure GitHub CLI as their credential helper with gh auth setup-git and use Git 2.46 or newer. This allows the CLI to supply refreshed credentials and helps prevent Git from caching an access token beyond its expiry.
Scripts and extensions that retrieve a token using gh auth token and save it for later use may also need changes.
A copied or cached access token will eventually expire, so applications consuming the token outside GitHub CLI should retrieve it again when needed. Tokens supplied through GH_TOKEN or GITHUB_TOKEN are not automatically refreshed by this feature.
The preview is available on GitHub.com and GitHub Enterprise Cloud’s ghe.com domain. GitHub Enterprise Server supports expiring credentials starting with version 3.23; earlier versions retain the existing non-expiring behavior when users opt in.
GitHub plans to make expiring credentials the default for new sign-ins in a future release, but it has not announced a date for that change. The company has published further details in its official announcement and the GitHub CLI v2.103.0 release notes.
Discover more from Aree Blog
Subscribe now to keep reading and get access to the full archive.
