GitHub Copilot Introduces Server-to-Server Authentication for Apps

GitHub Copilot gained public preview support for server-to-server authentication on October 27, 2026, for GitHub Apps installed on organizations. Services and agents built using the GitHub Copilot SDK now make requests on behalf of an organization without needing a signed-in user's credentials.

GitHub calls this a workload-owned identity. Automated services and agents run reliably at larger scale because authentication and usage no longer depend on individual users.

Setup requires three steps. First, grant a GitHub App the read-only Copilot Requests organization permission. Second, install the app on an organization. Third, pass a short-lived installation access token to the Copilot SDK.

Usage is billed to the organization owning the installation, and that organization's model policies, budgets, and spending controls apply directly to the app's requests. Organization owners review which apps have access to Copilot and identify app-attributed usage in AI usage CSV reports via the app_client_id field. Owners can also revoke access instantly by suspending or uninstalling the app.

Documentation provides guides on server-to-server authentication for the Copilot SDK alongside instructions for managing GitHub App access to an organization's Copilot instance.