ST-2026-210 · Authentication & identity
GitHub OAuth apps add rotating tokens and multiple redirect URIs
GitHub expanded OAuth app controls on 14 August 2026 with opt-in short-lived access and refresh tokens, up to 10 redirect URIs, and configurable wildcard matching for redirect URIs.
Previous state
OAuth apps used the prior token and callback configuration model, including a single registered callback URI and long-lived access-token behavior unless the application used other platform-specific controls.
Current state
OAuth apps can opt into eight-hour access tokens with six-month refresh tokens, register up to 10 callback URIs, and configure wildcard matching per redirect URI. Short-lived tokens are enabled by default for new applications.
Affected users
Who needs to care
Developers and administrators operating GitHub OAuth apps, plus GitHub Apps that use the newly explicit wildcard redirect control.
Required response
What to do
Add refresh-token handling before forcing short-lived tokens, register only required callback URIs, review legacy wildcard behavior, and disable wildcard matching where application routing does not require it.
Evidence boundary
What the source does not prove
The source proves the new OAuth app controls and stated token lifetimes. It does not force existing OAuth apps to enable short-lived tokens immediately; wildcard matching remains optional and has a documented legacy behavior for apps with one redirect URI.
Lifecycle history
Dated event sequence
- OAuth app token and redirect controls released
GitHub announced rotating tokens, up to 10 redirect URIs and explicit wildcard matching controls.
Evidence ledger
First-party sources
- 01GitHub — Multiple redirect URIs and token refresh for OAuth apps
Official GitHub Changelog · 2026-08-14
Open official source ↗