GitHub CLI Introduces Expiring and Auto-Refreshing OAuth Tokens
According to GitHub. GitHub announces a public preview of expiring, automatically refreshing OAuth credentials for its command-line interface.
- • Users can now opt into expiring access tokens that automatically refresh in the background.
- • The feature improves security by ensuring leaked access tokens become unusable within hours.
- • GitHub plans to make expiring credentials the default for new sign-ins in a future release.
New Authentication Mechanism
Starting with GitHub CLI v2.103.0, users can utilize expiring access tokens paired with rotating refresh tokens. This system automatically refreshes credentials as needed, allowing users to stay authenticated without manual re-authentication while reducing the window of opportunity for leaked tokens.
Configuration and Setup
Users can enable this feature by passing the --expiring flag during login or by running the configuration command to enable it globally. GitHub strongly recommends setting the CLI as the Git credential helper to ensure that expiring tokens are correctly handled during Git operations over HTTPS.
Compatibility and Limitations
The feature is currently opt-in and backward compatible. If a server does not support refreshable credentials, the CLI will fall back to standard non-expiring tokens. GitHub warns that scripts or extensions that cache tokens instead of fetching them fresh via the CLI may break when using expiring credentials.
- 1. github.blogOpen source