GitHub Desktop adds short-lived authentication tokens
Eligible accounts on GitHub Desktop 3.6.10 and later now get automatically refreshing tokens instead of long-lived ones, shrinking how long a leaked credential stays useful.
GitHub Desktop now issues short-lived, automatically refreshing authentication tokens to eligible accounts, GitHub said in a changelog post on 2 November. The change applies to version 3.6.10 and later, and it is rolling out gradually to accounts on github.com, including GitHub Enterprise Cloud.
Desktop handles the refresh itself, for both API requests and git operations, so there is nothing to configure day to day. The rollout excludes GitHub Enterprise Server entirely, and it is not retroactive: existing sessions stay signed in after you upgrade, but your current token is not swapped out automatically. A short-lived one is only issued the next time you sign in, once the rollout reaches your account.
Why it matters: a credential that leaks, from a misconfigured CI log, a stolen laptop or a compromised extension, is only as dangerous as the window it stays valid for. If you or your team use GitHub Desktop, update to 3.6.10 or later, but do not assume you are covered until you have actually signed in again, since an old long-lived token keeps working until you do.