A GitHub CLI token that leaks today can stay valid indefinitely. GitHub wants to shrink that to a few hours, and on Wednesday it began a public preview of expiring, self-refreshing OAuth credentials for the gh command-line tool.

Users who opt in get a short-lived access token stored alongside a rotating refresh token. The CLI refreshes the access token in the background whenever it is needed, so developers stay signed in without logging in again. If the access token leaks, GitHub said, it “becomes unusable within hours instead of lasting indefinitely.”

The feature needs gh v2.103.0 or later. Users can add the –expiring flag to gh auth login, or run gh config set expiring_credentials enabled to make it the default for every sign-in. The gh auth status command shows when the current access token expires.

Where scripts can break

The change is opt-in and backward compatible, and existing sign-ins and manually supplied tokens keep working as before. The risk sits in automation.…