GitHub CLI (gh) recently added short-lived access tokens that are refreshed automatically. It is a public preview and opt-in for now, but it is planned to become the default.

https://github.blog/changelog/2026-10-21-github-cli-opt-in-to-expiring-auto-refreshing-oauth-tokens/

This is a welcome change: a leaked access token now stops working within eight hours.

But the refresh token is a different story.

It lives for months, and gh stores it in the OS keyring, where on macOS any process running as you can read it without a confirmation dialog, as gh's own documentation acknowledges.

If malware steals the refresh token, it can keep minting new access tokens off your machine.

I develop ghtkn , a CLI that creates short-lived GitHub App user access tokens for local development, and it was designed with exactly this threat in mind.

This article compares ghtkn with gh's new short-lived tokens and explains what ghtkn protects against that gh doesn't.

How ghtkn refreshes tokens

Like gh, ghtkn issues access…