{
  "slug": "gh-opt-in-expiring-automatically-refreshed-oauth-credentials-54b44979f3d2",
  "title": "gh opt-in expiring, automatically refreshed OAuth credentials",
  "tools": [
    "gh"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-10-21T16:43:23.000Z",
  "announced_at": "2026-10-21T16:43:23.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "If you want expiring credentials, use GitHub CLI v2.103.0 or later and opt in when signing in or enable the preference for future sign-ins. For HTTPS Git operations, configure `gh` as the Git credential helper; read tokens fresh when needed and use `gh auth status` to check expiry.",
    "examples": [
      "gh auth login --expiring",
      "gh config set expiring_credentials enabled",
      "gh auth setup-git"
    ],
    "gotchas": [
      "Version: v2.103.0",
      "Availability: Public preview; available on github.com and ghe.com. GitHub Enterprise Server issues expiring tokens starting with GHES 3.23.",
      "Requires Install or upgrade to GitHub CLI v2.103.0.",
      "--expiring: Requests expiring credentials; the host must support issuing them.",
      "expiring_credentials (required): Config key for the preference to use expiring credentials at sign-in.",
      "expiring_credentials value: enabled (required): Enables the preference for expiring credentials.",
      "expiring_credentials value: disabled: Disables the preference; documented as the default.",
      "--hostname <string>: For `gh auth setup-git`, limits Git configuration to the specified host.",
      "Git version 2.46 or newer: Recommended so `gh` can mark expiring credentials non-cacheable; older Git still works but may allow a credential caching helper to reuse an expired token.",
      "Prerequisite: GitHub CLI v2.103.0 or later is required for expiring tokens.",
      "Prerequisite: Expiring tokens are available on github.com and GitHub Enterprise Cloud; unsupported hosts fall back to a non-expiring token. The release note specifies GHES starts issuing them at 3.23; earlier versions fall back.",
      "Prerequisite: For HTTPS Git operations, `gh` must be configured as the Git credential helper to serve and refresh the credential.",
      "On GitHub Enterprise Server versions earlier than GHES 3.23, opting in falls back to nonexpiring behavior.",
      "On git versions older than 2.46, `gh` still works but prints a one-time recommendation to upgrade.",
      "Scripts and extensions that store or copy a token obtained from `gh auth token` will eventually hold an expired token; when consuming the token outside `gh`, read it fresh each time.",
      "Hold off on opting in for a workflow that depends on a token that stays valid for a long time."
    ]
  },
  "why_it_matters": "If you want expiring credentials for GitHub CLI and use HTTPS Git operations, opt in at sign-in and configure `gh` as the Git credential helper.",
  "before": "The documentation says GitHub CLI authenticated by default with a long-lived token that did not expire; opting in is required for expiring tokens.",
  "sources": [
    "https://github.blog/changelog/2026-10-21-github-cli-opt-in-to-expiring-auto-refreshing-oauth-tokens",
    "https://cli.github.com/manual/gh_auth_login",
    "https://cli.github.com/manual/gh_config",
    "https://docs.github.com/en/enterprise-cloud@latest/github-cli/github-cli/authenticating-with-github-cli",
    "https://github.com/cli/cli/releases/tag/v2.103.0"
  ],
  "rank": 0.96058,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "daily-20261026-04",
    "verdict_id": "daily-20261026-04:daily-20261026-04-b89ad009c5639d09-0:gate",
    "evidence_hash": "6d44b5795705375f6acef29518888efdf2ff50deb97809c543485dfd9389feac"
  },
  "review": {
    "draft_hash": "329d6efb527049357d364919ace0da60d2b1ce09019eee4a6bba241215795506",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-21T16:43:23.000Z",
    "decision": "daily-20261026-04:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.96 >= 0.9; 2 needed) and Jev gave 0.64 (>= 0.6 needed)."
  }
}