Token expiration and revocation

Your tokens can expire and can also be revoked by you, applications you have authorized, and GitHub itself.

When a token has expired or has been revoked, it can no longer be used to authenticate Git and API requests. It is not possible to restore an expired or revoked token, you or the application will need to create a new token.

This article explains the possible reasons your GitHub token might be revoked or expire.

Note: When a personal access token or OAuth token expires or is revoked, you may see an oauth_authorization.destroy action in your security log. Para obter mais informações, consulte "Revisar o log de segurança."

Token revoked after reaching its expiration date

When you create a personal access token, we recommend that you set an expiration for your token. Upon reaching your token's expiration date, the token is automatically revoked. Para obter mais informações, consulte "Criando um token de acesso pessoal."

Token revoked when pushed to a public repository or public gist

If a valid OAuth token, aplicativo GitHub token, or personal access token is pushed to a public repository or public gist, the token will be automatically revoked.

OAuth tokens and personal access tokens pushed to public repositories and public gists will only be revoked if the token has scopes.

Token expired due to lack of use

GitHub will automatically revoke an OAuth token or personal access token when the token hasn't been used in one year.

Token revoked by the user

You can revoke your authorization of a aplicativo GitHub or aplicativo OAuth from your account settings which will revoke any tokens associated with the app. For more information, see "Reviewing your authorized integrations" and "Reviewing your authorized applications (OAuth)."

Once an authorization is revoked, any tokens associated with the authorization will be revoked as well. To re-authorize an application, follow the instructions from the third-party application or website to connect your GitHub account again.

Token revoked by the aplicativo OAuth

The owner of an aplicativo OAuth can revoke an account's authorization of their app, this will also revoke any tokens associated with the authorization. For more information about revoking authorizations of your OAuth app, see "Delete an app authorization."

Token revoked due to excess of tokens for an aplicativo OAuth with the same scope

Há um limite de dez tokens emitidos por combinação de usuário/aplicativo/escopo. If an application creates more than 10 tokens for the same user and the same scopes, the oldest tokens with the same user/application/scope combination will be revoked.

User token revoked due to aplicativo GitHub configuration

User-to-server tokens created by a aplicativo GitHub will expire after eight hours by default. Owners of Aplicativos do GitHub can configure their apps so that user-to-server tokens do not expire. For more information about changing how your GitHub App's user-to-server tokens behave, see "Activating optional features for apps."

Esse documento ajudou você?

Política de Privacidade

Ajude-nos a tornar esses documentos ótimos!

Todos os documentos do GitHub são de código aberto. Você percebeu que algo que está errado ou não está claro? Envie um pull request.

Faça uma contribuição

Ou, aprenda como contribuir.