GitHub Desktop adds short-lived authentication tokens

When you sign in to GitHub Desktop 3.6.10 or later, eligible accounts can now use short-lived, automatically refreshing authentication tokens.

Short-lived access tokens reduce how long a leaked token can be used. Desktop automatically refreshes them for GitHub API requests and Git operations, keeping token renewal out of your everyday workflow.

We’re rolling this out gradually on github.com, including GitHub Enterprise Cloud, so it isn’t available to everyone yet. This token rollout doesn’t include GitHub Enterprise Server. Existing sessions stay signed in after upgrading, and existing tokens aren’t automatically migrated. Short-lived tokens are issued during sign-in as the rollout reaches your installation.

Get the latest version of GitHub Desktop and see the GitHub Desktop authentication documentation for sign-in instructions. Share feedback or report a problem in the GitHub Desktop repository, or contact GitHub Support.