GitHub CLI previews expiring OAuth tokens with automatic refresh

GitHub has opened a public preview of expiring OAuth credentials that refresh automatically in the GitHub command-line tool, giving developers an alternative to access tokens that remain valid indefinitely.

The feature is optional in GitHub CLI version 2.103.0 and can be requested during sign-in with `gh auth login --expiring`. Developers can also enable the behavior for subsequent logins with `gh config set expiring_credentials enabled`. Once configured, the CLI stores an access token and a rotating refresh token, then renews access when necessary.

For HTTPS Git operations, GitHub recommends using `gh auth setup-git` so the CLI acts as a credential helper. GitHub also recommends Git 2.46 or later to prevent caching credentials beyond their expiry. Scripts that copy the result of `gh auth token` and reuse it indefinitely will need adjustment, because a previously exported value can expire even while the CLI remains authenticated.

The preview is available on github.com and ghe.com, with GitHub Enterprise Server support beginning in version 3.23. Existing sign-ins and manually supplied tokens are unchanged unless users opt in, and GitHub says it plans to make refreshing credentials the default for new sign-ins in a future release.