GitHub CLI adds opt-in expiring OAuth tokens in public preview
Starting with gh v2.103.0, logins can use short-lived access tokens that refresh automatically; scripts that cache tokens may need changes.
GitHub has added a public preview of expiring, automatically refreshing OAuth credentials to GitHub CLI. When a user opts in, gh stores a short-lived access token alongside a rotating refresh token and renews it as needed, so a leaked access token stops working within hours.
The feature starts with gh v2.103.0. Users can pass the expiring flag to gh auth login, or set the expiring_credentials configuration value to enabled. Running gh auth status shows when the current access token expires. It is opt-in and backward compatible, and existing sign-ins and manually supplied tokens keep working. GitHub says it plans to make expiring credentials the default for new sign-ins in a future release.
For git over HTTPS, GitHub recommends setting up gh as the git credential helper with gh auth setup-git, and using git 2.46 or newer. Tokens are available on github.com and ghe.com today, and on GitHub Enterprise Server from version 3.23.
Developers should check scripts and extensions that run gh auth token once and store the result, since the stored value will eventually expire. Reading the token fresh each time avoids that, and workflows that need a long-lived token may be better left out of the opt-in for now.
Sources
Verified Oct 23, 2026 (official source). githubdeveloper-toolssecuritycli