NewsBite analysis · Programming, Security
GitHub Blog
Multiple redirect URIs and token refresh for OAuth apps
GitHub has introduced updates to enhance the security of OAuth apps and GitHub Apps. Now, developers can opt for expiring access tokens which last for eight hours, complemented by a refresh token that remains valid for six months. Additionally, wildcard matching for redirect URIs is enabled, allowing more flexible but controlled routes for user authorization. This aims to improve app security and user experience during authentication.
Act nowConfidence: HighImmediate horizon
Published 14 Aug 2026, 23:45 UTC2 min read
Visit original article ↗Lead image — GitHub Blog
Summary
TL;DR
- OAuth apps can use expiring access tokens and refresh tokens.
- Wildcards allowed in redirect URIs for flexible app routing.
- Access tokens are valid for eight hours, refresh tokens for six months.
- Developers can add multiple redirect URIs easily.
- Short-lived tokens are enabled by default for new applications.
- Full details on updating app architecture will be provided.
Interesting facts
- Short-lived tokens improve security by minimizing the lifespan of access tokens.
- Wildcard matching can increase flexibility but requires careful route management.