GitHub adds expiring OAuth tokens and multiple redirect URIs for app developers

GitHub has released a security-focused update for OAuth apps and GitHub Apps that gives developers more control over how third-party integrations authenticate users and return them to applications. The changelog published on August 14 says OAuth apps can now opt in to expiring access tokens and refresh tokens, while apps can also support multiple redirect URIs. GitHub Apps and OAuth apps can additionally enable wildcard matching for redirect URIs when that flexibility is needed.

What changed for app builders

The most practical shift is token lifetime. When an OAuth app opts in, GitHub says the authorization flow issues an access token that lasts eight hours and a refresh token that is valid for six months. When the access token expires, the app exchanges the refresh token for a new token pair. That is a different operational model from long-lived bearer tokens, because apps need reliable refresh handling, storage protections and failure paths for users whose sessions cannot be renewed.

GitHub also added multiple redirect URI support for OAuth apps. That should reduce pressure on developers who maintain separate production, staging, local development or regional callback URLs. Instead of forcing teams into brittle workarounds, each approved callback can be registered directly. Wildcard matching is also available for both GitHub Apps and OAuth apps, but it should be treated as a sharper tool: useful for controlled subdomain patterns, risky if the matching rule is broader than the app actually needs.

Why it matters

OAuth redirect handling and token storage are common places for otherwise mature integrations to become exposed. Short-lived access tokens can limit the damage window when a token leaks from logs, a developer machine or an application dependency. Multiple redirect URIs can also make deployments cleaner by removing the need to overload a single callback path for every environment.

The CyberOGZ read: this may push GitHub integrations toward a more cloud-native authentication design, but it also raises the quality bar for implementation. Teams adopting the option should test refresh-token rotation, audit where refresh tokens are stored, and avoid using wildcard redirects as a convenience shortcut. The benefit is strongest when the new controls are paired with least-privilege scopes and clear separation between development and production apps.

For maintainers, the next thing to watch is adoption guidance from major GitHub integrations. The feature is optional, so users will not automatically gain better session limits unless app developers opt in and handle the new lifecycle correctly.

Sources

• github.blog

Cover photo by Laura Gigch on Pexels, used under the Pexels License.