ReleaseBytes
github GitHub Changelog ·

GitHub Enhances OAuth Apps with Expiring Tokens and Flexible Redirect URIs

securitygaengineer
feature

GitHub has rolled out multiple updates to its OAuth app and GitHub App platforms, enhancing security and developer flexibility. OAuth apps can now opt into using short-lived access tokens paired with refresh tokens, improving token rotation practices and secure development. Additionally, OAuth apps can register up to 10 redirect URIs, simplifying multi-environment deployments without separate app registrations. Both GitHub Apps and OAuth apps can also enable wildcard matching for redirect URIs, offering flexibility for related sites, though caution is advised. These improvements will be included in GitHub Enterprise Server 3.23.

  • →Support for expiring access tokens and refresh tokens
  • →Multiple redirect URIs for OAuth applications
  • →Wildcard matching for redirect URIs
Features (1) ›
  • Support for expiring access tokens and refresh tokens

    OAuth apps can now request short-lived access tokens (8 hours) with refresh tokens (6 months). This pattern, enabled by the `offline_access` scope or app registration settings, is the default for new applications and enhances token rotation security.

Enhancements (2) ›
  • Multiple redirect URIs for OAuth applications

    OAuth apps can now register up to 10 callback URIs, streamlining support for various environments, domains, or deployment configurations. This eliminates the need for creating separate apps for each distinct URL.

  • Wildcard matching for redirect URIs

    Both GitHub Apps and OAuth apps can now enable wildcard matching for individual redirect URIs, supporting redirection to multiple related sites like tenanted subdomains. Users should review app architecture to prevent abuse, especially with user-hosted content.

Read the original announcement →

https://github.blog/changelog/2026-08-14-multiple-redirect-uris-and-token-refresh-for-oauth-apps

Related releases