GitHub CLI adds opt-in expiring, auto-refreshing OAuth tokens in public preview
GitHub announced a public preview of expiring, automatically refreshing OAuth credentials in GitHub CLI (gh). When users opt in, gh stores an expiring access token alongside a refresh token.
Why it matters
Opting in replaces long-lived CLI credentials with short-lived access tokens that refresh automatically, which can reduce the impact of a leaked token for teams running gh in scripts, CI, or on shared machines.
Who should care
Developers and DevOps engineers who use GitHub CLI in scripts, automation, or CI pipelines; security teams managing developer credentials.
What you can do
Opt in to the public preview in a test environment with gh, confirm that token refresh works in your scripts and pipelines, and then review the GitHub CLI changelog for rollout details before enabling it more broadly.