We’ve released multiple updates to the OAuth app and GitHub App platforms to support more secure app development: OAuth apps can opt in to expiring access tokens and refresh tokens.…
We’ve released multiple updates to the OAuth app and GitHub App platforms to support more secure app development:
OAuth apps can opt in to expiring access tokens and refresh tokens.
OAuth apps can have multiple redirect URIs.
Both GitHub Apps and OAuth apps can enable wildcard matching for redirect URIs if needed.
Rotating tokens for OAuth apps
GitHub OAuth on mobile broke three times: deep links, PKCE, and one dumb redirect URL. Copy-paste fixes inside.
As announced in April 2026, GitHub is rolling out a new token format for GitHub App installation tokens. To help you validate…
I shipped a login API with one JWT that lived seven years and no way to revoke it, because the two-token access-and-refresh split…
A VS Code vulnerability in GitHub.dev lets attackers steal full GitHub OAuth tokens via a single malicious link, exposing all…
Self-Managed OAuth is now available to all developers on Cloudflare. Here's how we executed a zero-downtime migration of our core…
FastMCP's OAuthProxy issues its own tokens that are references into a key-value store. Here is what that store must hold for…
