On this page

GitHub’s Changelog dated October 27, 2026 says GitHub Copilot now supports server-to-server authentication for GitHub Apps installed on organizations, available in public preview. Services and agents built with the GitHub Copilot SDK can make requests on behalf of an organization without relying on a signed-in user’s credentials. Changelog calls this a workload-owned identity, so agents and automated services can run at larger scale without tying authentication or usage to individual users. Related reading: GitHub Copilot Assisted Permissions Is Generally Available.

That assisted-permissions article covers a different Copilot topic—tool-approval flows in CLI, app, and VS Code. Here the focus is organization-level installation tokens for the Copilot SDK. The two are not the same feature.

How the App path works

Developers give a GitHub App the read-only Copilot Requests organization permission, install the app on an organization, and pass a short-lived installation access token to the Copilot SDK.

Copilot SDK docs add these notes for services outside GitHub Actions:

  • Create the App with Copilot Requests set to Read-only, then install it on the organization that should own billing.
  • Mint an installation access token that includes the organization Copilot Requests permission; the resulting token typically starts with ghs_.
  • Installation tokens expire after one hour. Mint a new token before expiry, then restart the SDK client or host runtime with the new token.
  • The organization must be enabled for Copilot requests from GitHub App installations.
  • Pass the token through the SDK’s explicit option (gitHubToken, github_token, or the language-specific equivalent) and set useLoggedInUser: false. With that flag off, the runtime ignores automatic credential discovery, including environment tokens such as COPILOT_GITHUB_TOKEN. Existing runtime URI options follow the docs separately.

Billing and org controls

Usage is attributed and billed to the organization that owns the installation. The organization’s model policies, budgets, and spending controls apply. If a requested model is unavailable, docs point teams to confirm the org’s Copilot policy and the bundled runtime. For model lists and credit mechanics on this site, see GitHub Copilot Models List and Pricing (October 2026) and GitHub Copilot AI Credits Explained: Cost per Model.

Organization owners can review which apps have access, identify app-attributed usage in AI usage CSV reports via the app_client_id field, and stop access by suspending or uninstalling the app. Related team and org reading: GitHub Copilot in Teams Turns Notifications into Fixes and PRs.

GitHub Actions is a separate path

Docs also describe workflows in an organization-owned repository that grant the built-in GITHUB_TOKEN the permission copilot-requests: write. That Actions path needs no GitHub App and no stored authentication secret, and it is not the same enablement steps as the App installation-token flow above.

This is a public preview, not a generally available release. Org enablement, token minting, and SDK options can differ by account and runtime. Details follow GitHub Changelog and Copilot SDK docs. For reference only.

Related reading