GitHub CLI can rotate OAuth tokens now. Audit anything that caches them first.

GitHub CLI 2.103.0 can request short-lived, auto-refreshing OAuth credentials. Use gh auth login --expiring to opt in. The command gh config set expiring_credentials enabled enables the option for future sign-ins. The access token expires within hours; gh keeps a rotating refresh token and renews the credential in the background. ¹

Audit token consumers before enabling it. Scripts and extensions that capture gh auth token once will eventually hold an expired value. Read it fresh each time. For Git over HTTPS, run gh auth setup-git and use Git 2.46 or newer, as GitHub recommends, so a credential helper does not cache the token past its lifetime. ¹

Pilot this on a developer workstation. GitHub.com and ghe.com support the option now, and GHES starts with 3.23. An unsupported server falls back to a normal non-expiring token. Existing sign-ins stay unchanged; GitHub says expiring credentials are intended to become the default for new sign-ins later. ¹