Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Revoke the credential at the provider first, then delete every local copy and issue a replacement. Signing out of an IDE or running Copilot CLI’s /logout only removes a local session; it does not invalidate the server-side credential. The safest response to a leak, lost computer, departing employee, or suspected misuse is to inventory all copies, revoke the authorization or key, replace it with the narrowest practical scope and lifetime, update every integration, and verify that the old value fails.
Revocation, logout, and rotation are different operations
These terms describe separate changes:
- Logout removes a session or token from one device. It does not necessarily change what the provider will accept elsewhere.
- Revocation tells the provider to reject a specific OAuth grant, personal access token (PAT), API key, refresh token, or app authorization. A revoked credential cannot be restored.
- Rotation is the complete replacement process: revoke or disable the old value, create a new one, distribute it, remove stale copies, and test both success for the replacement and failure for the old value.
If a token may have been exposed, do not wait for its normal expiration. A local logout leaves copies in shell history, CI variables, editor state, keychains, configuration files, and other machines untouched.
Identify what you are revoking
AI coding products can use several credential classes. The class determines the correct control and how far a compromise can spread.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match| Credential | Typical use | Potential blast radius | Where to revoke | Replacement scope | Old-session behavior |
|---|---|---|---|---|---|
| OAuth authorization | IDE or CLI sign-in through a provider account | Any scopes granted to the client, potentially including code, organization, or repository access | Provider account settings under authorized applications | Reauthorize the client after revocation | Existing sessions may continue briefly; GitHub documents up to 30 minutes for an existing VS Code Copilot session |
| Classic or fine-grained PAT | Git, API, scripts, and automation | All repositories and API operations allowed by its scopes | Token settings or the provider’s credential-revocation API | Create a new PAT with only required repositories and permissions | Requests fail as soon as revocation propagates |
| Bearer API key | Agent APIs and service integrations | Every agent, repository, or operation permitted to that key | Provider dashboard or documented API; the exact control can vary by product version | Issue a separate key per integration and environment | Depends on provider-side invalidation and any already-issued short-lived tokens |
| Refresh token | Obtaining new access tokens without another interactive login | Long-lived ability to mint access tokens | OAuth application or account authorization controls | Complete the OAuth flow again and securely store the new refresh token | Access tokens minted before revocation may have a short remaining lifetime |
| Short-lived access token | Runtime calls after exchanging a longer-lived key | Usually limited by its expiry and granted scopes | Revoke the parent key or authorization; wait for expiry where no immediate control exists | Exchange a valid parent credential and honor the returned expiration | Expires at the provider-supplied time, not at a guessed fixed interval |
Emergency response when an AI coding token leaks
- Contain the source. Stop the affected job, disable a compromised integration, remove a secret from a public repository, and preserve relevant logs. Do not paste the token into an issue, chat, or ticket.
- Inventory every copy. Check IDE sessions, CLI credentials, OAuth grants, PATs, API keys, refresh tokens, operating-system keychains, configuration files, shell profiles, CI/CD secret stores, deployment platforms, containers, notebooks, and backup images.
- Revoke server-side first. Use the provider’s account control or documented API. If a machine is lost, perform this step from a trusted device; changing a local file on the lost machine is not containment.
- Remove local values. Delete keychain entries and plaintext configuration values, unset environment variables, remove obsolete CI secrets, and restart processes that may have read the old value.
- Issue a replacement. Choose the smallest repository, organization, agent, and operation scope. Prefer an expiration that matches the workload rather than an unlimited credential.
- Distribute safely. Update IDEs, CLI profiles, build runners, plugins, deployment secret stores, and documentation without committing the replacement to source control.
- Verify both directions. Make a harmless authenticated request with the new credential, then repeat an equivalent request with the old value and confirm that it is rejected.
- Investigate use of the old value. Review provider audit logs, repository events, OAuth grants, agent activity, and CI logs for unexpected access. Rotate related credentials if the attacker could have exchanged or copied them.
Revoke GitHub credentials directly
GitHub’s credential-revocation endpoint accepts classic PATs beginning ghp_, fine-grained PATs beginning github_pat_, OAuth app tokens beginning gho_, GitHub App user-to-server tokens beginning ghu_, and refresh tokens beginning ghr_. A request can include up to 1,000 credentials and returns HTTP 202 when GitHub accepts it for processing.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
The endpoint is unauthenticated so that a person who discovers someone else’s exposed token can submit it for revocation. You do not need to own the credential to report it. Once GitHub revokes a credential, it cannot authenticate Git or API requests and GitHub cannot reactivate it; generate a replacement instead.
Use the endpoint for automated incident response or bulk cleanup, and use the account’s token and application settings when you need to identify which grant, scopes, or organization access should be replaced. Treat an accepted 202 as confirmation that GitHub received the revocation request, then test the old value and monitor logs for any remaining use.
Revoke GitHub Copilot in VS Code
Copilot in VS Code can have both a GitHub OAuth authorization and a GitHub App authorization. Revoking only one can leave the other usable.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- On a trusted browser, open GitHub Settings.
- Open Applications and select Authorized OAuth Apps.
- Find GitHub for VS Code and choose Revoke.
- Open Authorized GitHub Apps. If a GitHub Copilot extension authorization is listed, revoke it as well.
- In VS Code, open the Accounts menu, sign out of the GitHub account, and close any remaining VS Code windows.
- Reopen VS Code and sign in again. Complete reauthorization so the editor receives a new grant.
GitHub states that an existing VS Code session can continue using Copilot for a maximum of 30 minutes after authorization revocation. During that window, do not treat a successful completion as proof that the old authorization remains valid; wait for the documented propagation period, restart the editor, and test again.
Log out and rotate Copilot CLI credentials
Where Copilot CLI looks for credentials
Copilot CLI stores its OAuth token in the operating-system credential store by default:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
- macOS: Keychain Access.
- Windows: Credential Manager.
- Linux: libsecret, such as GNOME Keyring or KWallet.
If no supported keychain is available, Copilot CLI can write plaintext credentials to ~/.copilot/config.json. It checks environment variables before stored credentials, in this order: COPILOT_GITHUB_TOKEN, then GH_TOKEN, then GITHUB_TOKEN. A replacement will appear not to work if an old higher-priority variable is still set.
Normal logout on a functioning machine
- At the Copilot CLI prompt, type
/logout. - Confirm that the local token has been removed from the keychain or configuration used by that installation.
- Unset any token environment variables in the current shell and in persistent shell profiles or CI configuration.
- Run
copilot loginand complete a new authorization. - Make a harmless request and confirm that the CLI is using the new account or authorization.
/logout removes the locally stored token but does not revoke it on GitHub. If the token may have been copied, lost with a laptop, or exposed in logs, revoke the Copilot CLI OAuth authorization in GitHub Settings under Applications before logging in again.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsClean up environment variables
For a POSIX shell, remove values from the current process with:
unset COPILOT_GITHUB_TOKEN GH_TOKEN GITHUB_TOKENAlso remove those assignments from shell startup files, CI variables, container definitions, and task-runner configuration. In PowerShell, remove current-process values with:
Remove-Item Env:COPILOT_GITHUB_TOKEN,Env:GH_TOKEN,Env:GITHUB_TOKENThen restart the terminal or service. Environment variables inherited by a running process remain in memory until that process exits.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Remove keychain and file copies
Use Keychain Access, Credential Manager, or the Linux secret-service manager to delete the Copilot entry after server-side revocation. Inspect ~/.copilot/config.json only when the keychain is unavailable or you need to remove a plaintext fallback. Protect the file while investigating; do not upload it for troubleshooting because it may contain an active credential or account metadata.
Remove an organization Copilot seat
Personal authorization revocation and organization seat cancellation solve different problems. Revoking a user’s OAuth or app authorization blocks that authorization immediately after propagation, but it does not change the organization’s billing assignment. Conversely, removing a seat controls entitlement but may not invalidate a personal token that was issued through another organization or account.
For Copilot Business or Enterprise, an organization owner can remove selected users or teams through GitHub’s Copilot user-management API. The endpoint is in public preview and requires the organization permissions documented by GitHub. GitHub marks selected seats as pending cancellation; users lose access at the end of the current billing cycle unless another team still grants Copilot access.
For an immediate security response, revoke the user’s authorizations and rotate exposed credentials first. Use seat removal separately for entitlement and billing cleanup, and check team memberships so a user does not retain access through another team.
Rotate Cursor credentials safely
Cursor Background Agents API
Background Agents uses a bearer API key. Keys are created in the Cursor Dashboard under Integrations and are scoped to the account, with permission to create and manage agents subject to the account’s plan limits and repository access.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
- Locate the key in the dashboard and identify every service, runner, or script that uses it.
- Inspect the current dashboard for the available disable, delete, or regenerate control. The published documentation does not establish one definitive revoke button or endpoint, so do not assume that a control has the same name in every dashboard version.
- Invalidate or delete the old key if the current dashboard provides that control. If it does not, contact the account administrator or provider support while removing the key from every integration and treating it as compromised.
- Create a replacement key with the narrowest available permissions and use separate keys for development, CI, and production.
- Update secret stores and restart workers. Test agent creation or management with the new key, then confirm the old bearer value is rejected.
Because a bearer key authorizes requests without an interactive login, assume anyone who obtains it can exercise all operations allowed by its scope until the provider invalidates it.
Cursor Origin
Origin exchanges a personal user API key for a short-lived access token. Integrations should read the returned expiresAt value and mint a new access token after that time; they should not assume a fixed lifetime in code. The documentation also calls for weekly rotation of Origin keys.
Store the personal key only in a server-side secret manager, keep the short-lived token in memory where possible, refresh before expiry with a small clock-skew margin, and revoke or replace the parent key if it is exposed. A short-lived token that remains valid cannot be made safer by deleting a local cache alone.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Rotate tokens for other AI coding tools
When a provider does not clearly distinguish logout from revocation, classify the credential before acting. An OAuth grant belongs in the provider’s authorized-application settings; a PAT belongs in token settings; a bearer key belongs in the product’s integration or developer dashboard; and a refresh token requires revoking the OAuth grant that issued it.
Use the same sequence for every provider: disable the server-side credential, remove local and CI copies, create a restricted replacement, update consumers, and test old-versus-new behavior. If documentation does not state how to revoke a key, do not claim that deleting a local file or logging out is sufficient. Treat the key as active until the provider confirms invalidation or its documented expiration has passed.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Design token rotation for automation
Interactive logins are manageable for a person; unattended jobs need an explicit lifecycle.
- Give each application, repository, environment, and runner its own credential instead of sharing one account-wide secret.
- Record owner, scopes, creation time, intended consumers, expiration, and the emergency revocation procedure in the secret inventory.
- Prefer short-lived access tokens derived from a protected parent credential. Refresh from the provider’s returned expiry value rather than a hard-coded duration.
- Use a secret manager with versioned values and an atomic rollout so workers can move from the old value to the replacement without printing either value.
- Keep a tested rollback plan that never re-enables a credential known to be exposed.
- Alert on use after revocation, access from unexpected locations, unusual repository breadth, and repeated authentication failures.
GitHub’s Copilot SDK guidance describes session-scoped token providers and refresh callbacks. It notes that production GitHub tokens typically last eight hours and that each token result must include expiresIn. That lifetime is guidance for the SDK flow, not a universal expiration for every GitHub credential.
Lost laptop or stolen workstation checklist
- From another trusted device, revoke the GitHub OAuth grants used by VS Code and Copilot CLI.
- Revoke any PATs, API keys, refresh tokens, and app authorizations that were present on the machine.
- Disable or rotate Cursor and other agent keys used by local scripts.
- Remove the machine from organization access, device-management systems, VPNs, and source-control sessions where applicable.
- Invalidate CI and deployment secrets if the laptop could read them.
- Review audit logs for repository clones, pull requests, issue changes, agent runs, and token use after the loss.
- Only after revocation, sign in on the replacement machine and issue fresh credentials.
Troubleshoot a token that appears to remain active
The old token still works immediately after revocation
Check whether you tested a different credential from an environment variable, keychain, or credential helper. Confirm the exact token prefix and value, wait for the provider’s stated propagation period, and retry from a clean process. GitHub documents up to 30 minutes for an existing VS Code Copilot session.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Copilot CLI keeps signing in as the old account
Run /logout, unset COPILOT_GITHUB_TOKEN, GH_TOKEN, and GITHUB_TOKEN, then remove the keychain or ~/.copilot/config.json entry. Restart the shell and CLI before running copilot login. The environment-variable precedence can silently override a newly stored login.
The replacement works locally but not in CI
Update the CI secret at the project, organization, and deployment-environment levels. Restart workers that cached the old variable, check that the new token has the required repository or organization scope, and ensure no fork or preview environment still references the prior secret.
A Cursor integration fails after rotation
Verify that the service received the replacement bearer key, that repository access and plan limits still permit the operation, and that Origin clients are honoring expiresAt. For Background Agents, check the current dashboard’s key status because the documented revoke control is version-sensitive.
Quick Recap
Final verification checklist
- The server-side OAuth grant, PAT, API key, or refresh token is revoked or replaced.
- Every local keychain, config file, shell variable, CI secret, container, and deployment store has been checked.
- The replacement has narrower scope and a documented expiration or rotation date.
- IDE and CLI sessions were reauthenticated after revocation.
- A harmless request succeeds with the replacement and fails with the old credential.
- Audit logs and repository activity show no unexplained use.
- Organization seat entitlement and personal authorization were handled as separate controls.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
