A stolen login token can give someone access long after the original leak. GitHub Desktop is starting to use shorter-lived tokens that refresh automatically—but updating the app alone does not switch an existing session.
What changed on November 2?
GitHub says GitHub Desktop 3.6.10 or later can issue short-lived, automatically refreshing authentication tokens to eligible accounts when they sign in. The desktop app handles token refresh for both Git operations and GitHub API requests, so users should not need to renew them manually.
The security benefit is narrower exposure if a token is leaked: a stolen short-lived access token should stop working sooner than a long-lived one. This does not make a compromised computer safe, and it is not a replacement for protecting your account.
How to get the improvement
- Update GitHub Desktop to version 3.6.10 or newer using the official download page.
- Check whether your account is eligible. GitHub is rolling the change out gradually on github.com, including GitHub Enterprise Cloud.
- Understand the sign-in requirement. Existing sessions remain signed in after updating, but their tokens are not automatically migrated. The new tokens are issued on sign-in once the rollout reaches your installation.
- Do not assume it is universal. GitHub Enterprise Server is explicitly excluded from this rollout.
Should you sign out and back in?
If your installation is eligible, signing in is the event that can issue a short-lived token. But because the rollout is gradual, signing out immediately does not guarantee you will receive one. Make sure you can authenticate again before ending an important working session.
There is no terminal command to enable this feature: it is an authentication change in GitHub Desktop, not a repository setting. GitHub has not announced a universal activation date in its November 2 notice.
The takeaway
Update Desktop, keep your sign-in recovery options working, and treat automatic token refresh as a useful reduction in credential exposure—not a promise that stolen credentials cannot be abused.