Key Takeaways
- GitHub's new OAuth updates (token refresh, multiple redirect URIs, wildcard matching) let Claude Code users secure integrations and support multi-env setups.
- Use offline_access to opt in, and disable legacy wildcard matching on single-URI apps.
What Changed
GitHub just shipped several updates to its OAuth app and GitHub App platforms that directly impact how you build integrations—including those powering Claude Code workflows. The key changes:
- Expiring access tokens & refresh tokens: OAuth apps can now opt in to short-lived access tokens (8 hours) and refresh tokens (valid 6 months). When the access token expires, the app uses the refresh token to get a new token pair.
- Multiple redirect URIs: OAuth apps can register up to 10 redirect URIs (called "callback URIs" on GitHub), making it easier to support multiple environments, domains, or deployment configurations without creating separate apps.
- Wildcard matching: Both OAuth apps and GitHub Apps can enable wildcard matching for each redirect URI, allowing redirects to multiple related sites (e.g., tenanted subdomains) without registering each one.
These improvements are included in GitHub Enterprise Server 3.23.
What It Means For You
If you're using Claude Code with GitHub integrations—whether you're building a custom MCP server, automating PR workflows, or syncing repos—these changes matter for two reasons:
Security: Long-lived tokens are a liability. If a token leaks, an attacker has persistent access. With expiring tokens, the blast radius is limited to 8 hours. Refresh tokens can be revoked independently.
Flexibility: Multiple redirect URIs mean you can run local development, staging, and production environments without juggling separate OAuth apps. Wildcard matching lets you support multi-tenant architectures without per-tenant registrations.
For Claude Code specifically, if you've built a custom OAuth flow to access GitHub APIs (e.g., to fetch issues, manage repos, or trigger CI), you should update it to use short-lived tokens. This reduces the risk of token theft from your local environment or CI logs.
Try It Now
1. Opt into token refresh
Add the offline_access scope to your authentication request. This triggers the short-lived token pattern. Example in your OAuth URL:
https://github.com/login/oauth/authorize?client_id=YOUR_CLIENT_ID&scope=repo offline_access&redirect_uri=https://yourapp.com/callback
Or, in your app registration settings, set your app to always use short-lived tokens. This forces old clients to update and ensures all clients get short-lived tokens.
2. Add multiple redirect URIs
Go to your OAuth app settings and click the new Add redirect URI button. Add up to 10 URLs, e.g., http://localhost:3000/callback for local dev, https://staging.example.com/callback, and https://app.example.com/callback.
3. Enable wildcard matching (carefully)
If you need to support tenanted subdomains, enable wildcard matching on a redirect URI. For example, https://{tenant}.example.com/callback would match any tenant subdomain.
Warning: Wildcard matching can be abused if the site being redirected to doesn't have strong control over its routes (e.g., if it hosts user content). Review your app architecture before enabling.
Also, note that apps with only one redirect URI have wildcard matching enabled by default (legacy behavior). Review your apps and disable wildcard matching if you don't need it. This applies to all OAuth apps and any GitHub App with a single redirect URI.
4. Update your Claude Code integration
If you have a Claude Code workflow that uses a GitHub OAuth token (e.g., via environment variables like GITHUB_TOKEN), update it to use the refresh flow. Most OAuth SDKs support refresh tokens—check your SDK's documentation. If your SDK doesn't support it, you can temporarily disable short-lived tokens while updating.
The Bottom Line
GitHub is pushing toward more secure OAuth practices. For Claude Code users, this means you can now build more secure, more flexible integrations without extra overhead. Take the time to migrate to short-lived tokens and review your redirect URI configuration—it's a small change that pays off in security and development speed.
Source: github.blog
