The News, Explained
GitHub has begun offering short-lived authentication tokens to eligible accounts signing in to GitHub Desktop 3.6.10 or later. The rollout is gradual across GitHub.com, including GitHub Enterprise Cloud. GitHub Enterprise Server is outside this rollout. Someone keeping an existing session after an upgrade may therefore be in a different position from someone signing in again. Source
An authentication token is a credential an app uses to make requests with an account’s permissions. The change gives that credential a shorter period of validity. GitHub says this limits the time a leaked token can be misused. Its announcement provides neither an exact token lifetime nor a measured reduction in security incidents. Source
A shorter lifetime is paired with automatic renewal. Desktop refreshes the tokens used for GitHub API requests and Git operations. An API is an interface through which software exchanges requests; Git operations include sending changes to a remote repository or bringing changes back. The design keeps repeated manual token renewal out of ordinary work. Source
Eligibility depends on the app version, the rollout reaching the installation, and sign-in. New tokens are issued during sign-in once the rollout reaches that installation. Existing sessions remain signed in after an upgrade, and their existing tokens are not automatically migrated. Source
Consider a hypothetical pair of users who both update to the latest version. One keeps an existing session; the other signs in on an installation reached by the rollout. Under the announced conditions, the first user’s existing token does not automatically change, while the second can receive a new token at sign-in. Source
The official authentication guide places the Accounts pane under GitHub Desktop’s Settings on macOS and File > Options on Windows, then directs authentication through a browser. Accounts with two-factor authentication complete that step in the browser. The guide explains the sign-in route and should be read alongside the announcement’s version, eligibility, and gradual-rollout conditions. Source · Source
OYOPICK’s Take
The useful combination here is a shorter credential lifetime with renewal handled by the app. Limiting the time a leaked credential remains usable is paired with a design that reduces repetitive work for users. Operational results are still needed to judge the size of the benefit, but bringing a security improvement into the normal workflow is a welcome direction. Source
The distinction between updating the app and changing its authentication credential deserves clear communication. Since an existing session stays signed in, the version number alone offers users an incomplete picture of their token’s status. As the rollout progresses, we would like the app to make both current eligibility and the conditions for new issuance easy to identify. Source