GitHub adds 8-hour OAuth tokens

GitHub now lets OAuth apps use eight-hour access tokens, six-month refresh tokens, and up to 10 redirect URIs in one app registration. The platform update says short-lived tokens are enabled by default for new applications, while wildcard redirect matching remains an opt-in control that can be abused when an app does not tightly control its routes. Agent and integration builders should treat this as a migration and review task—rotate credentials, test refresh handling, and audit callbacks before extending delegated access—alongside the archive’s GitHub agent control-plane analysis.