Value Prop
OAuth apps can now perform token rotation using short-lived access tokens and refresh tokens, giving developers a straightforward way to meet security standards and eliminating a source of long-lived tokens. This feature is opt-in for existing OAuth apps and on by default for newly created ones, so app developers can test and roll it out safely.
Expected Outcome
Rotating OAuth tokens regularly limits the window of exposure if a token is ever compromised — any previously exfiltrated token becomes invalid upon rotation. They also expire after 8 hours, the same as GitHub App user tokens. Developers building OAuth apps will be able to satisfy security policies that require credential rotation.
Value Prop
OAuth apps can now perform token rotation using short-lived access tokens and refresh tokens, giving developers a straightforward way to meet security standards and eliminating a source of long-lived tokens. This feature is opt-in for existing OAuth apps and on by default for newly created ones, so app developers can test and roll it out safely.
Expected Outcome
Rotating OAuth tokens regularly limits the window of exposure if a token is ever compromised — any previously exfiltrated token becomes invalid upon rotation. They also expire after 8 hours, the same as GitHub App user tokens. Developers building OAuth apps will be able to satisfy security policies that require credential rotation.