{
  "slug": "gh-auth-login-supports-expiring-oauth-credentials-e1155cc18094",
  "title": "gh auth login supports expiring OAuth credentials",
  "tools": [
    "gh"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-10-21T15:33:31.000Z",
  "announced_at": "2026-10-21T15:33:31.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When signing in with GitHub CLI v2.103.0 or later, use `gh auth login --expiring` to request refreshable credentials, or enable `expiring_credentials` to prefer them on every sign-in. For HTTPS Git, configure `gh` as the credential helper; fetch tokens with `gh auth token` when needed instead of caching them.",
    "examples": [
      "gh auth login --expiring",
      "gh config set expiring_credentials enabled",
      "gh auth setup-git"
    ],
    "gotchas": [
      "Version: v2.103.0",
      "Availability: Preview; available on github.com and GHE.com. Hosts that do not issue expiring credentials fall back to a regular non-expiring token.",
      "--expiring: Prefer automatically refreshed expiring credentials if the host supports them; otherwise gh falls back to a regular token.",
      "expiring_credentials: Configuration setting to prefer expiring credentials when logging in; allowed values are `enabled` or `disabled` (default `disabled`).",
      "gh auth token: Prints the active account's token, refreshing an expired or near-expiry refreshable token first unless `--no-refresh` is given. Run it again each time a token is needed; do not cache its output.",
      "GH_TOKEN / GITHUB_TOKEN: Environment-provided tokens are not refreshed.",
      "git: For HTTPS operations, git 2.46 or newer allows gh to mark credentials non-cacheable; older git may let a caching helper reuse an expired token.",
      "Prerequisite: Use GitHub CLI v2.103.0 or later; expiring tokens are supported on GitHub.com and GitHub Enterprise Cloud, subject to server support.",
      "Prerequisite: For HTTPS Git operations, configure gh as the Git credential helper with `gh auth setup-git`; Git 2.46 or newer is recommended.",
      "Expiring access tokens should not be cached; call `gh auth token` each time a token is needed.",
      "Tokens supplied through `GH_TOKEN` or `GITHUB_TOKEN` are never refreshed.",
      "For HTTPS git, the release advises git 2.46 or newer and configuring `gh` as the git credential helper with `gh auth setup-git` so git does not cache the token past its lifetime."
    ]
  },
  "why_it_matters": "Sign in to GitHub with credentials that expire and refresh automatically for CLI, API, and git operations.",
  "sources": [
    "https://github.com/cli/cli/releases/tag/v2.103.0",
    "https://github.com/cli/cli/pull/14450",
    "https://github.com/cli/cli/pull/14451",
    "https://github.com/cli/cli/pull/14452",
    "https://github.com/cli/cli/pull/14453",
    "https://github.com/cli/cli/pull/14454",
    "https://github.com/cli/cli/pull/14663",
    "https://github.com/cli/cli/pull/14717",
    "https://github.com/cli/cli/pull/14752",
    "https://cli.github.com/manual/gh_auth_login",
    "https://cli.github.com/manual/gh_config",
    "https://cli.github.com/manual/gh_auth_setup-git",
    "https://cli.github.com/manual/gh_auth_token",
    "https://docs.github.com/en/enterprise-cloud@latest/github-cli/github-cli/authenticating-with-github-cli"
  ],
  "rank": 0.98051,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "daily-20261026-04",
    "verdict_id": "daily-20261026-04:daily-20261026-04-512294fb58d84666-0:gate",
    "evidence_hash": "daf8d7920b07e1ab1d8d22a2b78aff3fc5ae43f810f284b8e8c3e117b57cbdf6"
  },
  "review": {
    "draft_hash": "179af6b6ce7ef314b21ea2a74dff18cecdf87e0bb01204efb9668a4092dfb212",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-21T15:33:31.000Z",
    "decision": "daily-20261026-04:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.98 >= 0.9; 2 needed) and Jev gave 0.72 (>= 0.6 needed)."
  }
}