One-Minute OAuth: Make GitHub Keys Expire in 30 Seconds
1. Opening: OAuth’s “Longevity Curse”
Developers’ favorite “one-click login” is actually a “long-lived token” trap: authorize once, GitHub Access Token lives 30 days, even 90 days. Once an AI assistant grabs the plaintext, it can quietly create repos, delete branches, push malicious code at midnight. Peta puts OAuth into a “math fresh box”: from authorization to expiry, whole process 60 seconds, key auto-expires in 30 seconds, cloud never sees plaintext.
2. Traditional OAuth vs. “Math Fresh Box”
Traditional: user clicks authorize → GitHub returns code → backend exchanges token → writes token to .env → remembers to delete after 30 days.
Peta: user clicks authorize → GitHub returns code → backend exchanges token → immediately cuts into 30-second JWT → auto-expires after 30 s, cloud keeps only ZKP shards, cannot reassemble full key.
3. One-Minute Live: GitHub Authorization Stopwatch
- 0–10 s: user clicks “Connect GitHub”, Peta pops auth window
- 10–20 s: user approves, GitHub returns code, backend exchanges Access Token
- 20–30 s: Peta cuts token into 30-second JWT + ZKP shards, shards uploaded to cloud, full key destroyed immediately
- 30–60 s: AI assistant calls GitHub API with JWT, cloud gateway verifies ZKP, injects real key, call completes
- 60 s: JWT expires, cloud shards insufficient, key vanishes forever
4. Math Details: 30-Second Countdown
JWT embeds「Unix timestamp + 30 seconds」, gateway checks every 0.3 ms, expires immediately 403.
ZKP shards: cloud only gets 2/5 Shamir shards, missing local 3/5, cannot reassemble full key.
Even if cloud breached, attacker only gets 30-second random handle, no long-term token.
Get Zhangshuang’s stories in your inbox
Join Medium for free to get updates from this writer.
5. Real Case: AI Auto-Generates Release Notes
- Developer clicks “Generate Release”
- AI reads latest 50 commits within 30 seconds, calls GitHub API, generates Markdown
- After JWT expiry, AI can no longer access repo, Release file already written locally
- Developer clicks “Publish”, pushes with manual token, AI never touched long-term key
6. vs. “Traditional Refresh Token”
Traditional: Refresh Token lives 90 days, after leak manual revocation needed, attacker can do anything during period.
Peta: 30-second JWT + shards, leak also auto-expires, cloud cannot restore, no manual intervention.
7. Batch Scene: 100 Repos, 100 Times, 30 Seconds
CI/CD pipeline needs Release Notes for 100 repos:
- Peta batch-issues 100 30-second JWTs, each for one repo
- Parallel calls, all completed within 30 seconds
- After expiry, batch shards auto-deleted, no long-term keys left in cloud
Ops no longer maintain “repo key table,” just click “generate.”
8. FAQ
Q: 30 seconds too short, call fails?
A: Gateway supports “auto-refill”: when JWT remaining 5 s, backend uses shards to refresh another 30-second round, frontend seamless.
Q: Developer doesn’t want to click authorize?
A: Can pre-generate “scoped long-term token,” but scope limited to “read commits,” still cut into 30-second JWT, leak also seamless.
9. Wrap-Up
When “authorization” drops from minutes to seconds, “leakage” changes from disaster to instant error. One-minute OAuth is not about faster flow, but about making “long-lived keys” disappear completely. Next article we enter the database: AI writes SQL and drops the database? Add an “invisible” LIMIT — stay tuned.
