Repository navigation
Document how to revoke all tokens #10095
Description
Description
gh auth logout help says thus:
➜ ~ gh auth logout --help
Remove authentication for a GitHub account.
This command removes the stored authentication configuration
for an account. The authentication configuration is only
removed locally.
This command does not invalidate authentication tokens.
It's a somewhat common question that people ask about revocation in some form or another:
- Invalidate previous OAuth token when a new one is generated with
gh auth#9233 - Oauth tokens should be visible and revokable in the user's account settings #9279
- Support for short-lived oauth tokens #5924
We should update the help text on gh auth logout to indicate that to revoke CLI generated OAuth tokens they should navigate to https://github.com/settings/applications (or equivalent on their targeted host) and click the Revoke button.
Acceptance Criteria
When I run gh auth logout --help
Then I see directions on how to revoke CLI OAuth tokens, and a warning that it will revoke all the OAuth tokens.
Notes
Should we also consider adding another issue for gh auth revoke-all --really-really-I-mean-it which does this programmatically? I think it's available via an API?
Activity
andyfeller commentedon Feb 24, 2025
@williammartin : I'm unsure if the OAuth authorization REST APIs are designed for anyone outside of the OAuth application owner to reset or delete a token, meaning I'm unsure if users can do it themselves. 🤔
BagToad commentedon Feb 24, 2025
FWIW, my understanding was the same: only the owner can do it from the API and users cannot.
williammartin commentedon Feb 25, 2025
Good to know, thank you.