Daily · · Copilot · 🌶️🌶️Worth a lookMedium: worth a look Why: Agents run without a user login
Copilot SDK agents get server-to-server auth
Your Copilot SDK agents can stop riding on someone’s login.
In public preview since Oct 27, 2026, a GitHub App installed on your organization can make Copilot requests for the org, with no signed-in user’s credentials. Usage is billed to the org.
What changed
Think of it as giving your bot its own badge instead of lending it yours.
GitHub calls this a workload-owned identity: the service or agent you built with the GitHub Copilot SDK acts as the organization, so it keeps working when the person who set it up is away or leaves.
How it’s set up
- Give a GitHub App the read-only
Copilot Requestsorganization permission. - Install the app on your organization.
- Pass a short-lived installation access token to the Copilot SDK.
What org owners keep
The org’s model policies, budgets and spending controls apply to these requests. Owners can see which apps have access, find each app’s usage in AI usage CSV reports under the app_client_id field, and cut access by suspending or uninstalling the app.
What to do
If a service of yours runs Copilot on a person’s token today, try moving it to a GitHub App. It’s a preview, so test it before you rely on it.
Source: GitHub Changelog: GitHub Copilot supports server-to-server authentication, Oct 27, 2026