--- title: Multiple redirect URIs and token refresh for OAuth apps description: GitHub has rolled out several security-focused updates to its OAuth app and GitHub App platforms. OAuth apps can now opt into expiring access tokens (8-hour... canonical: https://daily.dev/posts/multiple-redirect-uris-and-token-refresh-for-oauth-apps-htuxl850i twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Multiple redirect URIs and token refresh for OAuth apps | daily.dev og:description: GitHub has rolled out several security-focused updates to its OAuth app and GitHub App platforms. OAuth apps can now opt into expiring access tokens (8-hour... og:url: https://daily.dev/posts/multiple-redirect-uris-and-token-refresh-for-oauth-apps-htuxl850i og:image: https://api.daily.dev/og/posts/HtuXL850I.png og:image:alt: Multiple redirect URIs and token refresh for OAuth apps og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Multiple redirect URIs and token refresh for OAuth apps **[GitHub Changelog](https://daily.dev/sources/github_updates)** · 3 min read · 9 upvotes · 0 comments ## Summary GitHub has rolled out several security-focused updates to its OAuth app and GitHub App platforms. OAuth apps can now opt into expiring access tokens (8-hour lifespan) with 6-month refresh tokens, using the offline_access scope or a forced app registration setting. New apps get short-lived tokens by default. OAuth apps can also register up to 10 redirect URIs instead of just one, and both OAuth apps and GitHub Apps can enable wildcard matching for redirect URIs to support subdomains without registering each one individually. Notably, apps with a single redirect URI have had wildcard matching enabled by default as legacy behavior, which is now visible and configurable, and GitHub recommends reviewing and disabling it if unneeded. These changes will ship in GitHub Enterprise Server 3.23. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I enable refresh tokens for a GitHub OAuth app? Include the offline_access scope in the authentication request, which triggers issuance of a short-lived access token (valid 8 hours) plus a refresh token (valid 6 months) that can be exchanged for a new token pair. Alternatively, set the app registration to always use short-lived tokens, forcing all clients, including old ones, onto the new flow. Short-lived tokens are enabled by default for newly created OAuth apps. _daily.dev surfaces platform changes like this for teams rolling out token refresh in their OAuth integrations._ ### How many redirect URIs can a GitHub OAuth app have now? A GitHub OAuth app can register up to 10 redirect URIs, referred to as callback URIs on GitHub, instead of being limited to one. This lets a single app support multiple environments, domains, or deployment configurations without creating separate app registrations. The additional URIs are added through a new Add redirect URI button in the app's settings. _Teams managing multi-environment OAuth setups follow platform changes like this via daily.dev._ ### Why should I disable wildcard matching on my GitHub OAuth app's redirect URI? Wildcard matching lets GitHub send an authorization code to any subdomain or path under a registered redirect URI, which is risky if the target site doesn't tightly control its routes, such as one hosting user-generated content, because it can be abused to redirect codes to an attacker-controlled path. Any app that previously had only one redirect URI had wildcard matching enabled automatically as legacy behavior, now visible and controllable, so reviewing and disabling it where unnecessary is recommended. _daily.dev helps developers stay ahead of security-relevant defaults like this in their OAuth app architecture._ ## Similar posts on daily.dev - [Offline access tokens now support expiry and refresh](https://daily.dev/posts/offline-access-tokens-now-support-expiry-and-refresh-x4a6bm6ix) · Shopify Developer changelog · 0 upvotes · 0 comments - [Notice about upcoming new format for GitHub App installation tokens](https://daily.dev/posts/notice-about-upcoming-new-format-for-github-app-installation-tokens-639qmlcxz) · GitHub Changelog · 1 upvotes · 0 comments - [More resilient refreshes for expiring offline access tokens](https://daily.dev/posts/more-resilient-refreshes-for-expiring-offline-access-tokens-sxnqsmpn3) · Shopify Developer changelog · 0 upvotes · 0 comments - [Introducing Team Authorizations](https://daily.dev/posts/introducing-team-authorizations-0nmuow3zm) · Heroku · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#authentication](https://daily.dev/tags/authentication), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/multiple-redirect-uris-and-token-refresh-for-oauth-apps-htuxl850i) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Multiple redirect URIs and token refresh for OAuth apps","url":"https://daily.dev/posts/multiple-redirect-uris-and-token-refresh-for-oauth-apps-htuxl850i","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/multiple-redirect-uris-and-token-refresh-for-oauth-apps-htuxl850i"},"datePublished":"2026-08-14T23:23:46.476Z","dateModified":"2026-09-14T06:05:19.786Z","description":"GitHub has rolled out several security-focused updates to its OAuth app and GitHub App platforms. OAuth apps can now opt into expiring access tokens (8-hour...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ee80fc8c664cbcf85347b43bcc6723ac?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ee80fc8c664cbcf85347b43bcc6723ac?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"GitHub Changelog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitHub Changelog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/15004b7835da4d89b02b115871f0f6dc","url":"https://daily.dev/sources/github_updates"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/multiple-redirect-uris-and-token-refresh-for-oauth-apps-htuxl850i","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":9},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,github,authentication,oauth","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitHub Changelog","item":"https://daily.dev/sources/github_updates"},{"@type":"ListItem","position":3,"name":"Multiple redirect URIs and token refresh for OAuth apps"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/multiple-redirect-uris-and-token-refresh-for-oauth-apps-htuxl850i#faq","mainEntity":[{"@type":"Question","name":"How do I enable refresh tokens for a GitHub OAuth app?","acceptedAnswer":{"@type":"Answer","text":"Include the offline_access scope in the authentication request, which triggers issuance of a short-lived access token (valid 8 hours) plus a refresh token (valid 6 months) that can be exchanged for a new token pair. Alternatively, set the app registration to always use short-lived tokens, forcing all clients, including old ones, onto the new flow. Short-lived tokens are enabled by default for newly created OAuth apps. daily.dev surfaces platform changes like this for teams rolling out token refresh in their OAuth integrations."}},{"@type":"Question","name":"How many redirect URIs can a GitHub OAuth app have now?","acceptedAnswer":{"@type":"Answer","text":"A GitHub OAuth app can register up to 10 redirect URIs, referred to as callback URIs on GitHub, instead of being limited to one. This lets a single app support multiple environments, domains, or deployment configurations without creating separate app registrations. The additional URIs are added through a new Add redirect URI button in the app's settings. Teams managing multi-environment OAuth setups follow platform changes like this via daily.dev."}},{"@type":"Question","name":"Why should I disable wildcard matching on my GitHub OAuth app's redirect URI?","acceptedAnswer":{"@type":"Answer","text":"Wildcard matching lets GitHub send an authorization code to any subdomain or path under a registered redirect URI, which is risky if the target site doesn't tightly control its routes, such as one hosting user-generated content, because it can be abused to redirect codes to an attacker-controlled path. Any app that previously had only one redirect URI had wildcard matching enabled automatically as legacy behavior, now visible and controllable, so reviewing and disabling it where unnecessary is recommended. daily.dev helps developers stay ahead of security-relevant defaults like this in their OAuth app architecture."}}]} ```