GitHub Copilot supports server-to-server authentication
By Steven Van ·
GitHub Copilot now supports server-to-server authentication for GitHub Apps installed on organizations, available in public preview.
GitHub Apps installed on an organization can now authenticate GitHub Copilot requests without a signed-in user. The change is in public preview and applies to services and agents built with the Copilot SDK, as described in the server-to-server authentication docs.
How it works
A developer creates a GitHub App with the Copilot Requests organization permission set to read-only, then installs it on the organization that usage should be attributed and billed to. The app generates a short-lived installation access token (a ghs_ token), which is passed to the SDK through its explicit token option (gitHubToken, github_token or the language equivalent). Installation tokens expire after one hour, so a new token has to be minted and the SDK client or runtime restarted with it before expiry.
Setting useLoggedInUser to false turns off automatic credential discovery, including environment variable tokens such as COPILOT_GITHUB_TOKEN. The token therefore has to be passed explicitly. For an existing runtime URI, COPILOT_GITHUB_TOKEN is set on the runtime process instead. The docs show configuration examples in TypeScript, Python, Go, Rust, .NET and Java.
Billing and organization controls
- Usage is attributed and billed to the organization that owns the installation.
- The organization's model policies, budgets and spending controls apply.
- The organization must be enabled for Copilot requests from GitHub App installations.
- Owners can review which apps have access and identify app-attributed usage in AI usage CSV reports using the app_client_id field.
- Owners can stop an app's access by suspending or uninstalling it.
Inside GitHub Actions
Workflows in an organization-owned repository do not need a GitHub App. They can use the built-in GITHUB_TOKEN with the copilot-requests: write permission. This requires the organization's "Allow use of Copilot CLI billed to the organization" policy to be enabled, and needs no stored authentication secret.
