https://www.cloudkaramchari.com/tags/access-tokens/Recent content in Access Tokens on CloudkaramchariHugo -- gohugo.ioencloudkaramchariThu, 20 Aug 2026 21:00:00 +0530https://www.cloudkaramchari.com/blog/github-apps-oauth-apps-refresh-tokens-migration-guide/Thu, 20 Aug 2026 21:00:00 +0530https://www.cloudkaramchari.com/blog/github-apps-oauth-apps-refresh-tokens-migration-guide/ <h1 id="github-apps-and-oauth-apps-get-refresh-tokens-how-to-migrate-off-long-lived-access-tokens">GitHub Apps and OAuth Apps Get Refresh Tokens: How to Migrate Off Long-Lived Access Tokens</h1> <p>If you've built an OAuth App or a GitHub App that authenticates on behalf of users, there's a decent chance it's still handing out a <code>gho_</code> or <code>ghu_</code> token that never expires. On August 14, 2026, GitHub shipped token rotation for both app types: user access tokens now expire in 8 hours, refresh tokens last 6 months, and you get up to 10 redirect URIs per app instead of one. This walks through what changed, why the old model was a real liability, and exactly how to wire up the refresh flow.</p>