GitHub announced three changes to the OAuth app and GitHub App platforms in its changelog on August 14, 20261. The first is short-lived tokens: OAuth apps can request an access token that lives for eight hours paired with a refresh token valid for six months. Developers can opt in with the offline_access scope or set the app registration to always use them, and they are enabled by default for all new applications1. The second is support for up to 10 redirect URIs, so separate apps are no longer needed per environment1.
The third is per-URI wildcard matching. GitHub warns that it can be abused if the site being redirected to does not have strong control over its routes, and advises reviewing your app architecture before enabling it1. Notably, apps with only one redirect URI already have wildcard matching enabled — a legacy GitHub behavior that is now visible and controllable — and GitHub asks that you review your apps and disable it if you do not need it1. All of these will also be included in GitHub Enterprise Server 3.231.
Sources
- Multiple redirect URIs and token refresh for OAuth apps - GitHub official changelog (August 14, 2026)