New OAuth App features: Multiple redirect URIs, wildcarding, and token expiration and refresh

[hpsin]

🏷️ Discussion Type

Feature Announcement

💬 Feature/Topic Area

Apps

Body

We've shipped multiple updates to the OAuth and GitHub App platforms to help developers build more secure applications and handle more complex scenarios. See the changelog for more details.

What's new:

1. OAuth apps now support token expiration and refresh. Either as an app setting or per-request via the offline_access scope, OAuth apps can now get a short lived (eight hours) token and a refresh token to use when the access token expires. Learn about the new tokens and scope in the docs.
2. OAuth apps now support up to 10 redirect URIs instead of the single-URI limitation previously in place.
3. Both GitHub Apps and OAuth apps can enable wildcarding on a per-redirect-URI basis. This is not a best practice and we recommend against using it.

App developers should review their redirect URIs - if your app had only a single redirect URI registered, then it is and has been enabled for wildcard access since creation. If you do not require this wildcard access, you should disable it.

Please let us know your feedback, questions, or bug reports here. Thanks for building an app on GitHub!