ghtkn is a Go CLI and local agent daemon that obtains short-lived GitHub App User Access Tokens via the OAuth device flow, replacing long-lived PATs and CLI OAuth tokens. The Cobra-based CLI exposes commands such as init, auth, get, exec, git-credential, revoke, agent start/stop/lock/unlock/status/reset, info, docs, json-schema, and completion. The agent runs as a background daemon and speaks a JSON-lines protocol over a local socket with GET, SET, UNLOCK, STATUS, and STOP commands. Tokens are stored encrypted at rest using AES-256-GCM with an Argon2id-derived key-encryption key, one file per client ID with 0600 permissions and atomic writes.