GitHub Copilot adds server-to-server authentication for SDK agents
GitHub Copilot now supports server-to-server authentication for GitHub Apps installed on organizations, in public preview. Agents and services built with the Copilot SDK can make requests for an organization without a signed-in user's credentials. Usage is billed to the owning organization and governed by its model policies and budgets.
Key points
- Give the GitHub App the read-only Copilot Requests organization permission and install it on the organization.
- Pass a short-lived installation access token to the Copilot SDK instead of a signed-in user's credentials.
- Usage is billed to the organization that owns the installation, under its model policies and budgets.
- Use the app_client_id field in AI usage CSV reports to track app-attributed usage.
- Suspend or uninstall the app to stop its access.
- The feature is in public preview, so validate behavior before relying on it in production.
GitHub has added server-to-server authentication for Copilot, aimed at GitHub Apps installed on organizations, and it is currently in public preview. Services and agents built with the Copilot SDK can now act on behalf of an organization without borrowing a signed-in user's credentials. The goal is to give automated workloads their own identity, so they can run reliably at scale without their auth and usage being tied to one person.
To use it, a GitHub App needs the read-only Copilot Requests organization permission and must be installed on the organization. The app then passes a short-lived installation access token to the SDK. Usage is attributed and billed to the organization that owns the installation, and the organization's model policies, budgets and spending controls apply. Owners can see which apps have access, filter app-attributed usage in AI usage CSV reports via the app_client_id field, and revoke access by suspending or uninstalling the app.
Real-world use
- A nightly code review service that calls Copilot under the organization's quota instead of a developer's personal account.
- An internal automation agent shared by several teams, with its usage tracked against the organization budget.
- Background jobs with no signed-in user that need Copilot SDK agents to run with their own identity.
Why it matters
Automations you build with the Copilot SDK can run without depending on one developer's account, with access and usage managed at organization level. That simplifies identity and cost tracking for shared agents across a team.