GitHub CLI users can now opt into expiring OAuth tokens: the CLI automatically refreshes authentication, while a leaked access token becomes unusable within hours, according to GitHub. The feature is available as a public preview starting with v2.103.0.
Enable it with gh auth login --expiring. Support covers github.com, ghe.com and GitHub Enterprise Server 3.23 onward; unsupported servers fall back to a nonexpiring token. For Git over HTTPS, GitHub recommends gh auth setup-git and Git 2.46 or newer.
Scripts that save the output of gh auth token can break when it expires. Fetch it fresh for each use outside the CLI. GitHub advises postponing opt-in for workflows requiring long-lived tokens. Existing authentication remains unchanged unless users enable the feature.
Choose a sign-in method or comment as a guest below.