GitHub CLI Adds Expiring OAuth Tokens: Check Git, Scripts, and Extensions First
Automatic refresh is opt-in from v2.103.0, but cached-token workflows can break
Key takeaways
GitHub announced an opt-in public preview of expiring, automatically refreshing OAuth credentials for GitHub CLI on October 21, 2026, beginning with version 2.103.0. Users can enable the behavior with gh auth login --expiring or a global configuration setting. Git over HTTPS should use gh auth setup-git, and Git 2.46 or newer is recommended to avoid caching credentials beyond their lifetime. This article focuses on AI coding tools, scripts, and extensions that capture gh auth token output once and reuse it. It provides an inventory, migration, and verification sequence so users can gain a shorter exposure window without unexpectedly breaking long-running automation.
By ENHE AI · 2026-10-22 · AI-assisted drafting and editorial checks.
Direct answer: find every token cache before opting in
Expiring tokens shorten the useful life of a leaked access token, but they break scripts and extensions that read once and reuse forever. Search for gh auth token, environment exports, and credential copies before enabling the preview in a low-risk repository.
Confirmed version and behavior
Starting with GitHub CLI v2.103.0, users can enable the preview with gh auth login --expiring or set gh config set expiring_credentials enabled for future sign-ins.
GitHub CLI stores an expiring access token with a rotating refresh token and refreshes it when needed. A leaked access token becomes unusable within hours instead of remaining valid indefinitely.
Four checks before enabling
Upgrade to v2.103.0 or newer and use gh auth status to record the current account and host. Do not copy credentials into the report.
Search scripts and extensions for gh auth token followed by storage or copying into another tool. Change those workflows to read a fresh value each time.
For Git over HTTPS, run gh auth setup-git and prefer Git 2.46 or newer so expiring credentials are not cached beyond their lifetime.
In a low-risk repository, complete a pull, push, and one AI coding tool call, then inspect expiry state with gh auth status. Leave the preview or keep the previous sign-in path if any step fails.
Compatibility and fallback
The feature is opt-in and backward compatible. Servers that cannot issue refreshable credentials fall back to a normal nonexpiring token. It is available on github.com and ghe.com, while GHES support begins with version 3.23.
Why AI coding users should care
AI coding agents and extensions often combine several Git operations into long tasks, which can hide a read-once token assumption. Validation should cover task start, mid-run refresh, and final push rather than only successful login.
FAQ
Must I sign in again every day?
No. GitHub says gh refreshes automatically, though workflows still need handling for refresh failure or account revocation.
Do existing manual tokens change automatically?
No. Existing sign-ins and manually supplied tokens keep their current behavior unless the preview is enabled.
Related tools and reading
These pages support the same task, workflow, or risk boundary.
Conclusion
Fix every long-lived cache first, then validate a full low-risk workflow. The security gain matters only if automation does not silently break.
What this means for everyday users
AI coding agents and extensions often combine several Git operations into long tasks, which can hide a read-once token assumption. Validation should cover task start, mid-run refresh, and final push rather than only successful login.
Related tutorials
Related reading
How to Choose AI Agent Tools: Permissions, Logs, Review, and Sandboxes
Choosing an AI agent tool should start with controllability, not with a polished demo. CISA's May 1, 2026 guidance on careful adoption of agentic AI services highlights cybersecurity risks and safe design, deployment, and operation in IT environments. Ordinary users and small teams can use four criteria before connecting a tool to real work: whether permissions are granular, whether tool calls are logged, whether important actions require human confirmation, and whether the product supports sandbox testing. These criteria help users compare AI agents as workflow components rather than treating them as ordinary chatbots or standalone demos in everyday team workflows before rollout.
GitHub Models Is Retired as Copilot CLI and AI Credit Migration Moves Into Execution
GitHub Models was fully retired on July 30, 2026. The playground, model catalog, inference API, and bring-your-own-key access are no longer available, including for customers with active usage. ENHE's July 3 page had already documented the announced retirement date; this update changes the event from a future plan to a confirmed production state and adds migration checks. GitHub points users who need direct model access toward Microsoft Foundry and users building AI workflows on GitHub toward GitHub Copilot. Teams should inventory endpoints, keys, billing ownership, rate limits, model behavior, and rollback paths before replacing the retired service. The Copilot CLI and AI credit guidance remains relevant for governed automation.
GitHub Copilot Local Sandboxing Is Generally Available
GitHub made local sandboxing generally available on October 7, 2026 for GitHub Copilot CLI, the GitHub Copilot app, and VS Code sessions that use Agent Host. The feature applies operating-system controls to agent-run commands so users can restrict filesystem paths, network access, Git credentials, and supported local tools. GitHub's documentation also sets important boundaries: local sandboxing is off by default, CLI and app settings are separate, remote MCP servers are not sandboxed, and some in-process file tools enforce policy on a best-effort basis rather than through the operating-system sandbox. This guide focuses on verification rather than the toggle itself: enable the feature, test denied reads and writes, test blocked network access, confirm credential masking, inspect MCP placement, and configure fail-closed behavior where the organization requires enforcement.
From Chat Boxes to Personal AI Companions: AI Assistants Are Entering the Desktop Execution Era
AI assistants are moving from answering questions toward continuing real tasks. AI agents, MCP tool ecosystems, personal memory, and local workbenches are pushing this shift together. For users, the real value is not another chat box, but less repeated context setup and more continuity from thinking to doing.
ElevenLabs Launches Realtime Translation Alpha: How to Validate 90+ Languages
ElevenLabs announced the alpha release of Eleven Realtime Translation on October 21, 2026 for ElevenAPI enterprise customers. The service uses Eleven v4 Turbo, supports automatic language detection across more than 90 languages, and lets teams select from over 17,500 library voices or their own clones. This article turns the announcement into a small validation plan for customer calls and live events. It explains how to test language detection, names, numbers, latency, voice consistency, and human handoff while preserving the original transcript. The alpha label matters: teams should verify their actual language pairs and failure paths before treating the service as an unattended production interpreter.
Eleven Realtime v1 Mini and Max Launch: Choosing a Voice-Agent Path
ElevenLabs launched Eleven Realtime v1 Mini and v1 Max on October 20, 2026. Both speech-to-speech models support more than 90 languages and over 17,000 voices, but they target different tasks: Mini emphasizes lower-cost natural conversations, while Max is designed for support, lead qualification, and multi-step work. This article offers a selection and migration checklist instead of repeating benchmark claims. It explains how to compare both models on the same script, what OpenAI Realtime API compatibility means, why WebRTC integrations must move to WebSocket, and when ElevenAgents is the better starting point for channels, knowledge bases, guardrails, testing, and monitoring.