What changed
GitHub CLI added an opt-in public preview for expiring OAuth access tokens with rotating refresh tokens. The CLI refreshes credentials automatically, reducing the lifetime of a leaked access token while preserving interactive authentication across developer and agent workflows.
Why it matters
Long-lived CLI credentials are a high-value target in terminals, automation and coding-agent environments; shorter access-token lifetime can reduce exposure if refresh-token storage, revocation and failure behavior are also sound.
What to do
Enable the preview on a non-production account, record token lifetimes, test refresh, revocation, device loss and offline failure, inspect credential-store permissions, and keep repository scopes minimal before promoting it to agent or CI environments.
Caveat
This is an opt-in public preview. A rotating refresh token remains sensitive, local credential-store compromise is still material, and automatic refresh can hide authorization failures unless audit and revocation tests are explicit.