Copilot server-to-server auth: services and agents call Copilot as the organization, no user login
What is it?
Services and agents built on the Copilot SDK can now call Copilot with the permissions of a GitHub App installed on an organization, without a signed-in user's credentials. Give the app the read-only Copilot Requests organization permission, install it on the org, and pass a short-lived installation access token to the Copilot SDK.
Why does it matter?
Until now, internal bots and batch agents usually borrowed one employee's account, and broke whenever that person left or lost access. Usage is now billed to the organization, and its model policies, budgets and spending limits apply. Admins can track per-app usage through the app_client_id field in AI usage CSV reports and cut access by suspending or uninstalling the app.
Maturity
PreviewThis is a public preview, so permission names or billing details may change before general availability.
How to track it
- General availability: watch the GitHub changelog for the move to GA and for enterprise-level installs.
- Billing: check GitHub's billing docs for how app-driven usage counts against Copilot premium requests.