GitHub OAuth apps now support refresh tokens and multiple callback URLs

GitHub shares a changelog update for OAuth apps, covering refresh tokens, access token lifetimes, and support for multiple callback URLs. It also highlights configuration details like the offline_access scope and a security audit tip for legacy wildcard redirect URI matching.

Overview

Refresh tokens for GitHub OAuth apps

• GitHub OAuth apps now support 8-hour access tokens paired with 6-month refresh tokens.
• The update calls out configuring the offline_access scope to enable refresh tokens.
• It also mentions the ability to shorten token lifespans to improve application security.

Multiple callback (redirect) URLs

• OAuth apps can now add up to 10 callback URLs.
• This is positioned for supporting separate environments such as:
  • Development
  • Staging
  • Production

Security audit tip for legacy wildcard matching

• GitHub highlights an audit consideration related to legacy wildcard matching for callback/redirect URLs.
• The intent is to reduce risk from overly broad redirect URI patterns.

Related link

• GitHub changelog post: https://github.blog/changelog/2026-08-14-multiple-redirect-uris-and-token-refresh-for-oauth-apps/