gh opt-in expiring, automatically refreshed OAuth credentials

Introduced 2026-10-21 · score 0.96

HOW TO USE IT

If you want expiring credentials, use GitHub CLI v2.103.0 or later and opt in when signing in or enable the preference for future sign-ins. For HTTPS Git operations, configure `gh` as the Git credential helper; read tokens fresh when needed and use `gh auth status` to check expiry.

WHY THIS HELPS

If you want expiring credentials for GitHub CLI and use HTTPS Git operations, opt in at sign-in and configure `gh` as the Git credential helper.

BEFORE THIS CHANGE

The documentation says GitHub CLI authenticated by default with a long-lived token that did not expire; opting in is required for expiring tokens.

REQUIREMENTS AND LIMITATIONS

• Version: v2.103.0
• Availability: Public preview; available on github.com and ghe.com. GitHub Enterprise Server issues expiring tokens starting with GHES 3.23.
• Requires Install or upgrade to GitHub CLI v2.103.0.
• --expiring: Requests expiring credentials; the host must support issuing them.
• expiring_credentials (required): Config key for the preference to use expiring credentials at sign-in.
• expiring_credentials value: enabled (required): Enables the preference for expiring credentials.
• expiring_credentials value: disabled: Disables the preference; documented as the default.
• --hostname <string>: For `gh auth setup-git`, limits Git configuration to the specified host.
• Git version 2.46 or newer: Recommended so `gh` can mark expiring credentials non-cacheable; older Git still works but may allow a credential caching helper to reuse an expired token.
• Prerequisite: GitHub CLI v2.103.0 or later is required for expiring tokens.
• Prerequisite: Expiring tokens are available on github.com and GitHub Enterprise Cloud; unsupported hosts fall back to a non-expiring token. The release note specifies GHES starts issuing them at 3.23; earlier versions fall back.
• Prerequisite: For HTTPS Git operations, `gh` must be configured as the Git credential helper to serve and refresh the credential.
• On GitHub Enterprise Server versions earlier than GHES 3.23, opting in falls back to nonexpiring behavior.
• On git versions older than 2.46, `gh` still works but prints a one-time recommendation to upgrade.
• Scripts and extensions that store or copy a token obtained from `gh auth token` will eventually hold an expired token; when consuming the token outside `gh`, read it fresh each time.
• Hold off on opting in for a workflow that depends on a token that stays valid for a long time.

FIRST-PARTY EVIDENCE

• https://github.blog/changelog/2026-10-21-github-cli-opt-in-to-expiring-auto-refreshing-oauth-tokens
• https://cli.github.com/manual/gh_auth_login
• https://cli.github.com/manual/gh_config
• https://docs.github.com/en/enterprise-cloud@latest/github-cli/github-cli/authenticating-with-github-cli
• https://github.com/cli/cli/releases/tag/v2.103.0

Check the installed version and the source before using it. Entry JSON

Report a problem with this card