The News, Explained
On October 21, 2026, GitHub announced an opt-in public preview of expiring, auto-refreshing GitHub CLI tokens. Source
The CLI runs GitHub functions through terminal commands. Version 2.103.0, which includes the feature, is itself a regular release. Source
Staying signed in while tokens expire
OAuth tokens authorize an app to use granted account functions. From v2.103.0, the CLI can pair a short-lived access token for requests with a rotating refresh token for obtaining its replacement, refreshing when needed. Source
Use gh auth login --expiring to request this behavior. Issuance depends on the host and OAuth app’s support. Source
| Connection environment | Announced support |
|---|---|
| github.com and ghe.com | Expiring tokens supported |
| GitHub Enterprise Server 3.23 onward | Support begins |
| Earlier Enterprise Server | Falls back to non-expiring tokens |
Enterprise Server is GitHub’s product for organizations running their own instance. Existing sign-ins and manually supplied tokens keep their behavior. A future default change remains a plan. Source
gh auth status shows expiry with token values hidden. Scope changes using gh auth refresh also need --expiring or the preference setting to request expiring credentials. Automatic refresh has its separate role. Source
HTTPS Git and external scripts
For expiring HTTPS Git credentials, GitHub CLI must act as the credential helper, the program supplying credentials when Git requests them. The docs point to gh auth setup-git for configuring that role. Source
Git 2.46 or newer is recommended. It lets the CLI mark expiring credentials so caching helpers do not retain them beyond their lifetime. Older Git still works, but a helper may reuse an expired cached value. Source
Scripts or tools that store one result from gh auth token face a different condition: that copied access token eventually expires. GitHub recommends reading it fresh whenever an external consumer needs it, and delaying opt-in for workflows requiring long-lived tokens. Source
Storage also matters. The CLI uses the system credential store, falling back to a plain text file when the store is unavailable or problematic. This is an operating condition to consider alongside expiry. Source
OYOPICK’s Take
We would examine who refreshes a token alongside how briefly it remains valid. Distinguishing work mediated by the CLI or its credential helper from work reusing copied strings explains why adoption decisions can differ even within one account.
We hope this develops toward convenient everyday commands with less time for a leaked access token to remain useful. If the default changes later, clearly showing the actual server-issued credential type and external script dependencies could ease that transition. Making those boundaries understandable seems a useful criterion during the public preview.