GitHub announced a public preview of expiring, automatically refreshed OAuth tokens for GitHub CLI on October 21, 2026. Users of GitHub CLI 2.103.0 or later can opt in with `gh auth login --expiring`, or enable the corresponding global configuration before signing in. The change pairs a short-lived access token with a rotating refresh token, reducing how long a stolen access token should remain useful. It is not yet the default, and it does not retroactively convert every existing login.
The preview changes both login and Git credentials
After the opt-in login, GitHub recommends running `gh auth setup-git` so Git operations use the CLI credential helper. GitHub also recommends Git 2.46 or newer because older credential-cache behavior may retain an access token after it expires. A successful `gh` API call therefore does not prove that a separately cached HTTPS Git credential will refresh correctly.
The preview works on github.com and ghe.com. GitHub says Enterprise Server 3.23 begins issuing expiring tokens, while older servers fall back to the normal non-expiring token flow. Administrators should verify the server version and the actual token type rather than infer coverage from the client version alone.
Related sources: GitHub: expiring OAuth tokens for GitHub CLI ↗ · GitHub Docs: authenticating with GitHub CLI ↗
Scripts that cache token output need review
GitHub warns that extensions or scripts which capture the output of `gh auth token` and reuse it can fail after the access token expires. A safer pattern is to request a current token at the point of use, or let `gh` make the authenticated request. Never write either the access token or refresh token into logs, repository files or build artifacts.
For CI, continue using the platform-supported job token or an appropriately scoped app credential rather than treating an interactive CLI preview as an automatic replacement. Check scopes and host names, test expiry in a non-production account, and document how a user can sign out or revoke the authorization.
Related sources: GitHub: expiring OAuth tokens for GitHub CLI ↗ · GitHub Docs: authenticating with GitHub CLI ↗
Treat the fallback as compatibility, not proof of migration
If the server does not support the preview, GitHub says the CLI falls back to a conventional non-expiring token. That keeps login working, but it also means the security property being tested is absent. Record whether the result was an expiring token, which Git version handled credentials and whether a forced refresh completed.
Canadian teams can pilot with one developer or a disposable test account, exercise API and HTTPS Git paths, then inspect audit and revocation behavior before widening use. GitHub says it plans to make expiring tokens the default later; the announcement does not provide a general-availability date or evidence that a particular organization has migrated.
Sources and editorial method
We use the linked original statements and reports to distinguish documented facts from our analysis. Company announcements describe their authors’ plans and claims; they are not independent verification of future outcomes. This article is dated and will be revised if material evidence changes. Read our editorial standards and corrections process.
- GitHub: expiring OAuth tokens for GitHub CLI ↗ — October 21, 2026 announcement; version, commands, fallback and script-caching guidance.
- GitHub Docs: authenticating with GitHub CLI ↗ — Official authentication and Git credential context; reviewed October 22.