GitHub has introduced significant enhancements to OAuth apps and GitHub Apps allowing short-lived access tokens with refresh tokens and support for multiple redirect URIs including wildcard matching. These changes aim to bolster security, simplify multi-environment deployments, and improve developer workflows globally.
- Short-lived access tokens with long-lived refresh tokens introduced
- Support for up to 10 redirect URIs per OAuth app with wildcard options
- Legacy behavior of wildcard redirect matching is now visible and configurable
Infrastructure signal
The update introduces a shift in token lifecycle management for OAuth apps with the adoption of short-lived access tokens (8 hours) paired with refresh tokens valid for six months. This decreases risk exposure on cloud infrastructure by limiting token validity time and improving security posture. The change also impacts API authentication flows, requiring token refresh handling integrated into platform SDKs and server-side logic.
Additionally, the ability to register multiple redirect URIs (up to 10) along with wildcard matching enables more scalable and flexible redirect configurations. This reduces the need for creating separate OAuth apps per deployment environment or subdomain, simplifying infrastructure management. However, wildcard matching should be approached cautiously due to its potential for abuse if route control is weak.
Developer impact
Developers will need to adapt their authentication logic to support refresh token flows, which may require SDK updates or opting out for legacy compatibility. The default enablement of short-lived tokens on new apps encourages best security practices but demands enhanced token lifecycle handling in developer workflows.
The introduction of multiple redirect URIs and optional wildcard matching greatly improves flexibility during development and deployment. Developers can more easily test across stages or support multi-tenant architectures without managing numerous app registrations. Visibility into legacy wildcard behavior now allows developers to audit and tighten redirect URI configurations, reducing security risks.
What teams should watch
Security and platform teams should review OAuth app configurations to leverage refresh tokens and confirm SDK compatibility to avoid disruptions. Monitoring token renewal failures and validating refresh token security are critical in maintaining reliable authentication infrastructure.
Teams managing multi-environment or multi-tenant deployments must evaluate the benefits and risks of wildcard redirect URIs and consider disabling wildcard matching where unnecessary to mitigate potential redirect abuse. Regular audits of redirect URI setups will become a recommended practice as these changes propagate through GitHub Enterprise Server 3.23 and beyond.