GitHub lets Copilot SDK services use an organization identity
GitHub has put server-to-server authentication for the Copilot SDK into public preview. Its October 27 announcement lets services use a GitHub App installed on an organization instead of a signed-in person’s credentials. Requests are attributed and billed to that organization, with its model policies and spending controls still applying.
Read-only access can still spend credits
The organization administration guide covers owners with Copilot Business or Enterprise. The app needs the organization permission named Copilot Requests, set to Read-only. That label does not make requests free: they consume organization AI credits. Personal-account and enterprise-level installations cannot use this authentication method.
For an internal code-review service, the useful change is the identity behind a request. The service can have an organizational owner instead of borrowing an employee login. That does not decide which repositories it should inspect, who accepts its suggestions or how much output is worth paying for. Those remain application-design decisions.
The token lifecycle is part of the integration
The SDK runtime instructions require an installation token with Copilot permission from an enabled organization. Tokens expire after one hour. For a child runtime, pass the token through the explicit SDK option, such as gitHubToken, and set useLoggedInUser: false. That disables automatic credential discovery, including environment-variable tokens. Merely putting a token in COPILOT_GITHUB_TOKEN is not equivalent in this configuration.
Mint a replacement before expiry. Refresh requires restarting the SDK client with the new token for a child process. In-process or existing runtimes require a host-runtime restart. An existing runtime URI has a different setup: its process receives COPILOT_GITHUB_TOKEN. The documented steps do not establish seamless continuation of an in-flight task across that restart.
GitHub Actions uses a different route
For organization-owned repository workflows, the GitHub Actions guidance uses the built-in GITHUB_TOKEN and copilot-requests: write. It also requires the organization policy named Allow use of Copilot CLI billed to the organization. The GitHub App route does not require that policy. Do not copy the app’s Read-only permission into workflow YAML and assume the two paths are interchangeable.
Attribution is available before per-app budgets
App-attributed usage appears in AI usage CSV exports, not the AI usage screen. Match app_client_id to an installation’s client_id. Its app_slug identifies the app. Organization budgets apply, but an individual app or installation cannot have its own budget. An alert-only budget does not halt spending. Stopping at the limit requires the stop-usage setting.
Suspending or uninstalling an app installation stops its requests, but also blocks that installation’s other organization-resource access. A team planning to use that control should account for the app’s other jobs, rather than treating suspension as a Copilot-only switch.
A useful pilot tests ownership, renewal and reporting
Consider a service that prepares a repository summary overnight. Before expanding it, a team could use a small synthetic job to check which organization receives the charge, how the worker handles token replacement and whether the resulting CSV identifies the intended app. Keep a separate record of work completed before restarting, so a retry is not automatically treated as a fresh job. This is a proposed evaluation, not a test ByteForward has run.
Billing attribution answers a different question from activity capture. Our guide to Copilot telemetry controls covers the latter, including the distinction between identity fields and conversation or tool content.
The preview removes the signed-in-user dependency for this route. Its practical value depends on completing the surrounding operational work: assign an owner, plan credential renewal and reconcile usage with the service that generated it. A successful connection alone does not demonstrate those pieces work together.
