Short-lived credentials change the automation contract.
GitHub CLI adds refreshable OAuth credentials. Scripts that capture a token once deserve a closer look.
What changed
GitHub’s public preview offers opt-in expiring credentials from CLI v2.103.0. The CLI refreshes them automatically; tools that retain a copied access token may instead encounter expiry.
Go to the source ↓Why it matters
Shorter credential lifetimes reduce how long a leaked access token remains useful. They also expose an assumption common in unattended scripts: that authentication is permanent.
The migration unit is the workflow, not just the login command. Check who refreshes credentials, which process consumes them and how a failure becomes visible.
What remains unproven
The feature is opt-in and in preview. It does not automatically repair scripts that cache credentials outside the CLI.
The useful next step
Inventory unattended jobs that depend on CLI authentication. Test a complete run and its refresh path in an isolated environment before changing production credentials.
A secure credential still needs a reliable refresh path.