gh auth login supports expiring OAuth credentials

Introduced 2026-10-21 · score 0.98

HOW TO USE IT

When signing in with GitHub CLI v2.103.0 or later, use `gh auth login --expiring` to request refreshable credentials, or enable `expiring_credentials` to prefer them on every sign-in. For HTTPS Git, configure `gh` as the credential helper; fetch tokens with `gh auth token` when needed instead of caching them.

WHY THIS HELPS

Sign in to GitHub with credentials that expire and refresh automatically for CLI, API, and git operations.

REQUIREMENTS AND LIMITATIONS

• Version: v2.103.0
• Availability: Preview; available on github.com and GHE.com. Hosts that do not issue expiring credentials fall back to a regular non-expiring token.
• --expiring: Prefer automatically refreshed expiring credentials if the host supports them; otherwise gh falls back to a regular token.
• expiring_credentials: Configuration setting to prefer expiring credentials when logging in; allowed values are `enabled` or `disabled` (default `disabled`).
• gh auth token: Prints the active account's token, refreshing an expired or near-expiry refreshable token first unless `--no-refresh` is given. Run it again each time a token is needed; do not cache its output.
• GH_TOKEN / GITHUB_TOKEN: Environment-provided tokens are not refreshed.
• git: For HTTPS operations, git 2.46 or newer allows gh to mark credentials non-cacheable; older git may let a caching helper reuse an expired token.
• Prerequisite: Use GitHub CLI v2.103.0 or later; expiring tokens are supported on GitHub.com and GitHub Enterprise Cloud, subject to server support.
• Prerequisite: For HTTPS Git operations, configure gh as the Git credential helper with `gh auth setup-git`; Git 2.46 or newer is recommended.
• Expiring access tokens should not be cached; call `gh auth token` each time a token is needed.
• Tokens supplied through `GH_TOKEN` or `GITHUB_TOKEN` are never refreshed.
• For HTTPS git, the release advises git 2.46 or newer and configuring `gh` as the git credential helper with `gh auth setup-git` so git does not cache the token past its lifetime.

FIRST-PARTY EVIDENCE

• https://github.com/cli/cli/releases/tag/v2.103.0
• https://github.com/cli/cli/pull/14450
• https://github.com/cli/cli/pull/14451
• https://github.com/cli/cli/pull/14452
• https://github.com/cli/cli/pull/14453
• https://github.com/cli/cli/pull/14454
• https://github.com/cli/cli/pull/14663
• https://github.com/cli/cli/pull/14717
• https://github.com/cli/cli/pull/14752
• https://cli.github.com/manual/gh_auth_login
• https://cli.github.com/manual/gh_config
• https://cli.github.com/manual/gh_auth_setup-git
• https://cli.github.com/manual/gh_auth_token
• https://docs.github.com/en/enterprise-cloud@latest/github-cli/github-cli/authenticating-with-github-cli

Check the installed version and the source before using it. Entry JSON

Report a problem with this card