Revoking GH CLI oauth token

July 23, 2026 · Jerome Gill

Revoking a gh CLI Token (Properly)

If a GitHub CLI token leaks gh auth logout is not enough to revoke the token. It only deletes the token from your local credential store, at least on osx. The token itself stays valid on GitHub’s servers.

Why gh auth logout doesn’t work

gh cli authenticates as an OAuth app, not a classic personal access token. That means the token won’t show up under Settings → Developer settings → Personal access tokens, and there’s no per-token revoke button anywhere.

Verify it

Test the old token directly against the API:

curl -sI -H "Authorization: token OLD_TOKEN_HERE" https://api.github.com/user

Run gh auth logout, then run this. It still returns 200 OK — the token is still live, you just can’t use it from that machine anymore.

The actual fix

  1. Go to github.com/settings/applications.
  2. Find GitHub CLI (check both the “Authorized OAuth Apps” and “Authorized GitHub Apps” tabs — it can appear under either).

  3. Click it, then Revoke access. This invalidates every token that app has issued, on every machine.

  4. Re-authenticate with: 
    gh auth login

This generates a fresh token, replacing the one you just killed.

Github should make it very clear in the UI all valid tokens and when they were most recently used. But it doesn’t. Hopefully this helps someone. Run the curl command again — it now returns 401 Unauthorized.