GitHub Desktop 3.6.10 issues short-lived, self-refreshing tokens to cut leaked-token risk
Victoria Shinder1 min readGitHub Desktop can now sign eligible accounts in with short-lived authentication tokens that refresh automatically. GitHub announced the change in its changelog; it applies to Desktop 3.6.10 and later.
The point is to shorten how long a leaked token stays useful. Desktop refreshes the tokens on its own for GitHub API requests and for Git operations, so renewal stays out of the user's daily work.
The rollout is gradual on github.com, including GitHub Enterprise Cloud, so not every installation has it yet. GitHub Enterprise Server is not part of this rollout. Existing sessions stay signed in after the upgrade and existing tokens are not migrated: short-lived tokens are issued at sign-in once the rollout reaches an installation. GitHub points users to the Desktop authentication documentation for sign-in steps.
What it means
The benefit only arrives at the next sign-in. Teams that want it on their machines should upgrade to 3.6.10 and sign out and back in once the rollout has reached them; a long-lived token from an old session keeps working, and keeps its old risk, until then.