GitHub Apps and OAuth Apps Get Refresh Tokens: How to Migrate Off Long-Lived Access Tokens If you've built an OAuth App or a GitHub App that authenticates on behalf of users, there's a decent chance it's still handing out a gho_ or ghu_ token that never expires. On August 14, 2026, GitHub shipped token rotation for …