GitHub CLI can now use expiring sign-in tokens: how to opt in and what to check first

What changes when you opt in

By default, GitHub CLI signs in with a long-lived token that does not expire. If that token leaks, it keeps working until someone revokes it by hand. ^[3]

With the new option, GitHub CLI keeps a short-lived access token together with a rotating refresh token, and renews the access token on its own when it is needed. Because the access token expires within hours, a leaked copy stops working within hours. ^{[1] [2] [3]}

Nothing changes unless you opt in. Existing sign-ins and tokens you supply yourself keep working as before. GitHub says it plans to make expiring credentials the default for new sign-ins in a future release. ^{[1] [3]}

How to turn it on

The --expiring flag is a request, not a guarantee. If the server does not support expiring tokens, GitHub CLI falls back to a normal non-expiring token and shows an informational message. ^{[4] [3]}

1. Update GitHub CLI to v2.103.0 or later; expiring tokens are not available in older versions. ^{[3] [1]}
2. Sign in with gh auth login --expiring to request expiring credentials for that sign-in. ^{[1] [4]}
3. Optionally run gh config set expiring_credentials enabled so every future sign-in requests expiring credentials; pass --expiring=false when one sign-in needs a non-expiring token. ^{[1] [4]}
4. Run gh auth status to see whether the credential is refreshable and when the current access token expires. By default it also refreshes an expired or near-expiry token; add --no-refresh if you only want to look. ^{[2] [5]}

If you use Git over HTTPS

For Git operations over HTTPS, GitHub CLI has to be Git's credential helper so it can hand Git a fresh token. Running gh auth setup-git sets that up. ^{[3] [6]}

GitHub also recommends Git 2.46 or newer, so an expiring credential is not kept by a caching credential helper after it has expired. Older Git versions still work, with a one-time upgrade notice. ^{[3] [1]}

1. Run gh auth setup-git so Git uses GitHub CLI as its credential helper for your signed-in hosts. ^{[3] [6]}

Scripts and tools that reuse a token

Anything that runs gh auth token once, saves the value and uses it later will eventually hold an expired token. GitHub's advice is to call gh auth token each time the token is needed; that command refreshes the token first unless --no-refresh is used. ^{[1] [7]}

In practice, the places to look are long-running jobs and tools that were given a copied token, because they are the ones that would keep using a value captured hours earlier. ^{[1] [7]}

gh auth token prints the real credential, so treat its output like a password: pass it straight to the tool that needs it and keep it out of logs, screenshots and shared chats. A leaked copy still works until it expires, or until it is revoked if it is a non-expiring token. ^{[3] [1] [7]}

If a workflow really needs a token that stays valid for a long time, GitHub suggests not opting in for that workflow. ^[1]

Tokens you supply through environment variables are separate from this feature. GitHub CLI uses a GH_TOKEN or GH_ENTERPRISE_TOKEN value instead of stored credentials and does not write it to disk, and tokens supplied through GH_TOKEN or GITHUB_TOKEN are never refreshed, so automatic renewal does not apply to them. ^{[3] [2]}

Manually supplied tokens keep working as before; opting in to expiring credentials does not change them. ^{[1] [3]}

Changing scopes later

When you add scopes with gh auth refresh, include --expiring or keep the expiring_credentials setting enabled. Otherwise the scope change can replace your expiring credential with a non-expiring one. ^[3]

Where expiring tokens are available

Availability depends on where your account lives. On hosts that do not issue expiring tokens yet, opting in falls back to a non-expiring token, and GitHub CLI shows an informational message. ^{[4] [3] [1]}

Frequently asked questions

Next step

GitHub's documentation explains every way to sign in to GitHub CLI, including expiring tokens, in one place.

Product demos and reference material

• github.blog — official reference
• github.com — official reference
• docs.github.com — official reference
• cli.github.com — official reference
• cli.github.com — official reference
• cli.github.com — official reference
• cli.github.com — official reference

Sources

1. https://github.blog/changelog/2026-10-21-github-cli-opt-in-to-expiring-auto-refreshing-oauth-tokens/
2. https://github.com/cli/cli/releases/tag/v2.103.0
3. https://docs.github.com/en/github-cli/github-cli/authenticating-with-github-cli
4. https://cli.github.com/manual/gh_auth_login
5. https://cli.github.com/manual/gh_auth_status
6. https://cli.github.com/manual/gh_auth_setup-git
7. https://cli.github.com/manual/gh_auth_token