What changed
On October 27, 2026, GitHub opened public-preview server-to-server authentication for the Copilot SDK. A GitHub App installed on an organisation with the read-only Copilot Requests organisation permission can obtain a short-lived installation access token and pass it to the SDK. Requests are attributed and billed to the owning organisation, not a particular developer account. Organisation model restrictions, budgets and spending controls apply. Owners can inspect installed apps, use the app_client_id field in AI usage CSVs, and suspend or uninstall apps to revoke access.
Why it matters
Long-running agents and backend services have often relied on a developer's personal authentication, creating brittle ownership and audit trails when employees leave or tokens expire. App installation identities make access attributable to a workload and easier to govern at organisation scope. However, an app token is still powerful operational authority, and this is a public preview rather than a mature general-availability contract.
Workload identity instead of borrowed user credentials
The service creates a GitHub App, requests the organisation-level read-only Copilot Requests permission, installs it on an organisation and supplies a short-lived installation access token to the Copilot SDK. The request no longer needs a logged-in user's personal token. This is a Copilot SDK authentication path, not a general permission to read arbitrary private repositories or mutate their contents.
Billing, model controls and audit
Usage is billed to the organisation owning the installation and remains subject to its model policies, budgets and spending limits. GitHub's AI usage CSV exposes app_client_id for attribution. Owners can review apps with access and suspend or uninstall them. Teams should separately govern any other GitHub App repository permissions their agent needs.
Production safeguards and limits
Use short-lived installation tokens, keep signing credentials outside logs, scope installations and permissions to the minimum necessary, and record requests per app. Test token refresh, rate limits, budget exhaustion, app suspension and model policy rejection. GitHub labels the feature public preview; pricing and API compatibility should be monitored as it evolves.
What this does not do
A read-only Copilot Requests permission allows model requests but does not automatically grant repository access, tool execution rights or permission to deploy. Copilot's separate local sandbox and assisted approval settings remain distinct controls. A backend service should not assume its model-generated actions are safe just because authentication is organisation-owned.