GH-AUTH-REFRESH(1) GitHub CLI manual GH-AUTH-REFRESH(1)

# [NAME](#NAME)

gh-auth-refresh - Refresh stored authentication credentials

# [SYNOPSIS](#SYNOPSIS)

**gh auth refresh \[flags]**

# [DESCRIPTION](#DESCRIPTION)

Expand or fix the permission scopes for stored credentials for active account.

The **--scopes** flag accepts a comma separated list of scopes you want your gh credentials to have. If no scopes are provided, the command maintains previously added scopes.

The **--remove-scopes** flag accepts a comma separated list of scopes you want to remove from your gh credentials. Scope removal is idempotent. The minimum set of scopes (**repo**, **read:org**, and **gist**) cannot be removed.

The **--reset-scopes** flag resets the scopes for your gh credentials to the default set of scopes for your auth flow.

If you have multiple accounts in **gh auth status** and want to refresh the credentials for an inactive account, you will have to use **gh auth switch** to that account first before using this command, and then switch back when you are done.

For more information on OAuth scopes, see

⟨https://docs.github.com/en/developers/apps/building-oauth-apps/scopes-for-oauth-apps/⟩.

# [OPTIONS](#OPTIONS)

[**-c**, **--clipboard**](#c)

Copy one-time OAuth device code to clipboard

[**-h**, **--hostname** **<string>**](#h)

The GitHub host to use for authentication

[**--insecure-storage**](#insecure_storage)

Save authentication credentials in plain text instead of credential store

[**-r**, **--remove-scopes** **<strings>**](#r)

Authentication scopes to remove from gh

[**--reset-scopes**](#reset_scopes)

Reset authentication scopes to the default minimum set of scopes

[**-s**, **--scopes** **<strings>**](#s)

Additional authentication scopes for gh to have

# [EXIT CODES](#EXIT_CODES)

0: Successful execution

1: Error

2: Command canceled

4: Authentication required

NOTE: Specific commands may have additional exit codes. Refer to the command's help for more information.

# [EXAMPLE](#EXAMPLE)

```
# Open a browser to add write:org and read:public_key scopes
$ gh auth refresh --scopes write:org,read:public_key
# Open a browser to ensure your authentication credentials have the correct minimum scopes
$ gh auth refresh
# Open a browser to idempotently remove the delete_repo scope
$ gh auth refresh --remove-scopes delete_repo
# Open a browser to re-authenticate with the default minimum scopes
$ gh auth refresh --reset-scopes
# Open a browser to re-authenticate and copy one-time OAuth code to clipboard
$ gh auth refresh --clipboard
```

# [SEE ALSO](#SEE_ALSO)

[**gh-auth(1)**](/man/os/gh/gh-auth.1)

Oct 2026

---

Document: gh-auth-refresh(1) from gh 2.102.0-r2 (Chainguard OS)
Source: https://github.com/cli/cli