GitHub CLI adds optional expiring OAuth tokens with automatic refresh

Starting with version 2.103.0, the GitHub CLI can be configured to use expiring OAuth tokens that automatically refresh when needed. The change is optional and backward compatible, but it alters how credentials are stored and refreshed, which directly affects automation, git operations, and security posture.

How to Enable Expiring Credentials

To activate the feature for a single login, add the --expiring flag to the authentication command:

gh auth login --expiring

To make it the default for all future sign‑ins, set the configuration key once:

gh config set expiring_credentials enabled

After enabling, the CLI handles token refreshes in the background; no additional commands are required for day‑to‑day use.

Impact on Git Operations

If you use HTTPS for git, configure the CLI as the credential helper so it can supply and refresh the expiring token on demand:

gh auth setup-git

The helper works best with git version 2.46 or newer, which respects the token’s expiry and avoids caching it beyond its lifetime. Older git versions still function, but they emit a one‑time recommendation to upgrade.

Operational and Security Considerations

Expiring tokens are short‑lived, so any process that captures the token once and reuses it later will eventually encounter authentication failures. Scripts that call gh auth token and store the result should be updated to request a fresh token each time instead of caching the value. The CLI will fall back to a non‑expiring token if the server does not support refreshable credentials, preserving existing workflows. Future releases plan to make expiring tokens the default for new sign‑ins, so teams should evaluate current automation for compatibility now.

Related CloudNinjas coverage: security.

What This Means For Practitioners

Adopt the --expiring flag or the global config setting in a controlled environment, verify that your CI/CD scripts retrieve tokens on demand, and ensure git is upgraded to 2.46+ where possible. Monitor any automation that relies on long‑lived tokens and adjust it to handle refresh failures gracefully. By doing so, you limit the window of exposure for leaked credentials while maintaining seamless authentication across development and operations workflows.