My personal access token still works even after expiring. I'm worried.

[vjtvalero]

Select Topic Area

Question

Body

I'm using a Linux Ubuntu computer. I started to worry when I cloned a 'private' repository and then I remembered that my personal access token has expired several days ago already. I checked the cached credentials using sudo cat ~/.git-credentials and the https://:<personal_access_token>@github.com is still there.
I checked in my GitHub settings to confirm if I really have no new tokens generated and there is none.
Am I missing something here?

[jdevfullstack]

was there notification in your email that it expired ? because that is maybe cached data

[vjtvalero]

There was. So the cached token should not work.

[byrneh]

Most likely you are authentizating by other means in you local config. That could another cached credential generated by say Web auth flow, in a cached Credential Manager or cloning using SSH protocol.

You can always call the USER rest api providing the in the header credentials which should fail if you it mở longer eít on your due to expiry or deletion.

[DSDmark]

sed -i '/https:\/\/:<personal_access_token>@github.com/d' ~/.git-credentials

This command will delete the entry for the expired personal access token from the ~/.git-credentials file which is your local Git configuration.

[vjtvalero]

Most likely you are authentizating by other means in you local config. That could another cached credential generated by say Web auth flow, in a cached Credential Manager or cloning using SSH protocol.

You can always call the USER rest api providing the in the header credentials which should fail if you it mở longer eít on your due to expiry or deletion.

I have no SSH set up anymore by the way.

[spenserblack]

How did you clone the repo? If you used gh clone, for example, I believe it uses the token in ~/.config/gh/hosts.yml.

Edit: gh repo clone, not gh clone

[DSDmark]

Here is the documentation https://cli.github.com/manual/gh_repo_clone

[spenserblack]

Thanks for the correction! I made a gh clone alias for gh repo clone, and I use it so much it slipped my mind that gh clone doesn't exist as a subcommand 🙃

[vjtvalero]

I cloned the repo the normal way: git clone <https_url> or probably the SSH way. but I have no SSH keys set up anymore. Does that mean the old SSH key still works?

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬