GitHub OAuth apps get refresh tokens and 10 redirect URIs
GitHub has changed how OAuth apps handle login tokens and redirect addresses, giving developers stronger defaults for securing third-party integrations. The updates, published in the GitHub Changelog on August 14, 2026, introduce expiring access tokens with refresh support, up to 10 redirect URIs per OAuth app, and controllable wildcard matching for redirect URLs GitHub Changelog.
Why it matters
Until now, OAuth apps on GitHub typically relied on long-lived access tokens, which widen the blast radius if a token leaks. GitHub announced that apps can now request a short-lived access token during the user authentication flow GitHub Changelog. GitHub says that when an app opts in, it receives an access token that lives for eight hours and a refresh token valid for six months. When the access token expires, the app presents the refresh token to obtain a fresh token pair, forcing regular rotation without manual re-authorization.
Developers can enable the change in two ways. GitHub says adding the offline_access scope to an authentication request triggers the short-lived pattern immediately, which the company recommends for testing and gradual rollout GitHub Changelog. Alternatively, an app registration can be set to always use short-lived tokens, a lever for forcing older clients to update. GitHub enables short-lived tokens by default for all new applications, and teams whose SDK does not yet support the refresh flow can temporarily disable it while upgrading Authorizing OAuth apps.
More redirect addresses
GitHub announced that OAuth apps can now register up to 10 redirect URIs, which the platform labels “callback URIs,” so a single app can serve multiple environments, domains, or deployment configurations without spawning duplicate apps GitHub Changelog. GitHub also added a new “Add redirect URI” button in application settings so developers can add URLs to match against GitHub Changelog. This removes a common workaround where teams created separate app registrations for staging, production, and regional deployments.
Wildcard matching, now visible and controllable
GitHub says both OAuth apps and GitHub Apps can enable wildcard matching for each configured redirect URI, allowing redirects to related sites such as tenanted subdomains without registering each one About the user authorization callback URL. GitHub warns this can be abused if the destination does not tightly control its routes, and notes that single-redirect apps historically had wildcard matching on by default. Apps with only one redirect URI keep wildcard matching enabled as a legacy behavior, so developers should review and disable it if unneeded.
The improvements ship in GitHub Enterprise Server 3.23 GitHub Changelog. For teams building on GitHub, the changes reduce token-lifetime risk and cut the operational overhead of managing many deployment targets under one app identity.
Related reading: GitHub Copilot improves context handling, routing to cut token waste
