GitHub CLI can now auto-refresh short-lived OAuth tokens
A new public preview lets gh swap long-lived OAuth tokens for ones that expire within hours and refresh themselves automatically.
GitHub CLI can now use expiring, self-refreshing OAuth credentials, available from 21 October as a public preview. Opt in with gh auth login --expiring, or turn it on for an existing session with gh config set expiring_credentials enabled.
Once enabled, gh stores a short-lived access token alongside a rotating refresh token and swaps it out automatically whenever one is needed, including during gh auth status, gh auth token, and git operations once you run gh auth setup-git. You stay signed in without reauthenticating. The feature needs GitHub CLI v2.103.0 or later, GitHub recommends git 2.46 or newer, and it is available on GitHub Enterprise Server from version 3.23.
Why it matters: a stolen long-lived CLI token has historically kept working until someone notices and revokes it. GitHub says a leaked access token under this scheme becomes unusable within hours instead of lasting indefinitely, which shrinks the damage from a leaked laptop or CI secret considerably.
The caveat: it is opt-in and still a public preview, so existing gh sessions keep their current long-lived tokens until you switch over.