{"version":"2.1.314","anchor":"oauth-token-minting-in-github-app-setup-now-validated-before","canonical_anchor":"oauth-token-minting-in-github-app-setup-now-validated-before","heading":"GitHub app setup now checks its sign-in token before using it","tier":"notice","area":"Elsewhere","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.314\/e\/oauth-token-minting-in-github-app-setup-now-validated-before","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.314","markdown":"### GitHub app setup now checks its sign-in token before using it\n\nDuring GitHub app setup, Claude Code now checks the long-lived token before accepting it and revokes a held-back token if you cancel\n\n**What**\n\nWhen you set up the GitHub app, Claude Code signs you in and creates a long-lived token, a saved credential that lets it act on your behalf. Before, it accepted that token as soon as sign-in finished. Now it checks the token first:\n\n- If the check refuses the token, Claude Code shows the refusal message exactly as given and does not offer a retry.\n\n- If you cancelled the setup dialog while a token was being held back, that token is revoked so it cannot be used.\n\n**Why**\n\nIt adds a policy check to the path that creates long-lived tokens, so a token that should not be issued is not quietly accepted.\n\n- Area: Elsewhere\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: no"}