GitHub CLI Adds Expiring OAuth Tokens: How to Enable Them and Check Integrations

A token copied once into a variable or script may stop working when it expires. On October 21, 2026, GitHub announced a public preview of expiring OAuth credentials with automatic refresh in GitHub CLI. The opt-in mode is designed for workflows where the CLI itself manages authentication.

How to enable refreshed credentials

You need GitHub CLI version 2.103.0 or later. To opt in for an individual login, add the --expiring flag:

gh auth login --expiring

To request refreshed credentials for subsequent logins as well, run:

gh config set expiring_credentials enabled

The CLI stores an expiring access token together with a rotating refresh token and refreshes the credentials when needed. The gh auth status command shows the authentication state and the current token’s expiration. The flag requests refreshed credentials; whether they are issued depends on the host’s capabilities and the OAuth application configuration. If the server does not support them, the CLI uses a regular, non-expiring token.

Configure Git as a credential consumer

For HTTPS repositories, configure GitHub CLI as Git’s credential helper:

gh auth setup-git

Git will then request credentials from gh, which can refresh them before use. GitHub recommends Git version 2.46 or later: it lets the CLI mark expiring credentials so Git does not cache them beyond their expiration. GitHub CLI also works with older Git versions, but prompts once to upgrade.

After configuring it, test a normal Git operation over HTTPS, such as checking the state of the remote repository. Make sure Git obtains credentials through the helper: this tests the entire authentication path, not just the CLI login.

Check scripts and external applications

A potential weak point is a script or extension that runs gh auth token once, saves the string, and reuses it later: that access token may expire. If an external process needs a token, request a fresh one each time it runs with gh auth token. The consumer must be able to use the current value and handle token expiration.

Before enabling the mode in a production environment, check CI jobs, local scripts, editor extensions, and tools that obtain tokens from an environment variable or configuration file. Find out whether they request a current value at startup or rely on a saved copy. Keep the existing authentication method for processes that require a long-lived token.

Where the feature is available

GitHub announced support on github.com and ghe.com. GitHub Enterprise Server issues these credentials starting with version 3.23; on earlier versions, a request for refreshed credentials falls back to a regular, non-expiring token. The mode is currently opt-in; GitHub plans to make it the default for new logins over time.

Practical steps: update GitHub CLI, enable requests for refreshed credentials, configure Git with gh auth setup-git, and check external processes for token storage. This can help identify incompatible workflows before switching over.

GitHub published details in its preview announcement and the gh auth login command documentation.