GitHub CLI v2.103.0 can use expiring, auto-refreshing OAuth tokens, so a leaked token stops working within hours
Coding agents drive a lot of repository work through gh, so token lifetime decides how bad a leak gets. How to turn it on and what it can break.
// Key points
- In public preview: log in with gh auth login --expiring, or run gh config set expiring_credentials enabled to opt in for every sign-in.
- gh stores an expiring access token alongside a rotating refresh token and refreshes it in the background; a leaked access token becomes unusable within hours instead of lasting indefinitely.
- GitHub strongly recommends gh auth setup-git so gh serves the credential to git, and git 2.46 or newer so expiring credentials aren't cached past their lifetime.
- It's opt-in today and planned as the default for new sign-ins in a future release; scripts and extensions that store the output of gh auth token for reuse will break.
Builder's takeOn dev machines and cloud sessions where agents run gh, I'd turn this on first; like the package firewall, it shrinks the blast radius of the credentials an agent holds. Before you do, search your scripts for places that write the output of gh auth token to a file or environment variable, and change them to fetch it each time.
// Background · from #Coding agents
Full timeline →- Oct 22 Claude Code 2.1.307 emits an OpenTelemetry event each time a safety layer stops, prompts or sends back a tool call
- Oct 21 GitHub package firewall enters public preview, screening npm traffic between coding agents, CI and the registry
- Oct 21 Cloudflare and VoidZero introduce tsrs, a Rust port of the TypeScript compiler up to 8x faster than TypeScript 7.0 with about 70% less memory