Copilot agents can now bill an organization, no signed-in user needed

Microsoft’s GitHub has added server-to-server authentication to Copilot in public preview. Services built with the Copilot SDK can now act for an organization through a GitHub App, with no signed-in user behind the request.

A GitHub App token replaces a person’s login

Until now, an agent built on the Copilot SDK needed a person’s credentials to make requests. According to GitHub, the new route gives the workload its own identity, so agents and automated services can run at larger scale without tying their authentication or usage to individual users.

The setup, as GitHub describes it, has three steps. A developer gives a GitHub App the read-only Copilot Requests organization permission. The app is then installed on an organization. Finally, a short-lived installation access token is passed to the Copilot SDK. The organization that owns the installation is the one charged for what the app consumes, and its own model policies, budgets and spending controls govern that consumption.

GitHub’s linked documentation adds detail the changelog leaves out. Installation tokens expire after one hour, so a long-running service has to mint a new one and restart the SDK client or host runtime with it. The docs list TypeScript, Python, Go, Rust, .NET and Java as supported SDK languages. The token must be requested with the organization_copilot_requests permission set to read, and the resulting ghs_ token is handed to the SDK explicitly. The organization must also be enabled for Copilot requests from GitHub App installations.

For work inside GitHub Actions the docs describe a simpler path: grant copilot-requests: write in the workflow permissions and pass GITHUB_TOKEN, with no separate app or stored secret.

Owners get an audit trail and a kill switch

Organization owners can review which apps have access and spot app-attributed usage in AI usage CSV reports through the app_client_id field. To cut an app off, they suspend or uninstall it.

The management documentation sets some limits. Only apps installed on an organization qualify; personal-account and enterprise installations cannot use this method. Owners cannot set a budget for one app or one installation, because usage counts against the organization’s overall Copilot budget. GitHub also warns that a budget that only sends alerts will not stop spending, so owners who want a hard ceiling should enable the stop-usage option. App attribution appears only in CSV exports, not in the AI usage view, and the field is empty for user-attributed usage and GitHub Actions.

Neither the changelog nor the two documentation pages say which Copilot plans include the feature, whether it costs extra beyond normal request billing, or when it leaves preview. Those points remain open.

Agent identity becomes a billing and governance question

The change matters most to teams that run Copilot-powered bots, review tools or internal agents. Before, such a service either borrowed a developer’s login, which made usage hard to separate from that person’s own, or could not be run unattended at all. With an installation token, the cost lands on an organization’s budget and shows up in a report, and an owner can switch it off without touching anyone’s account.

It also fits a wider push to treat agents as identities in their own right. At TechXchange, IBM made its Agent Identity and Vault 2.2 generally available, and IBM wants every AI agent to have an owner, an ID and a kill switch. Citing Gartner, IBM projects the average Fortune 500 company will run more than 150,000 agents by 2028, while only 13% of organizations consider their agent governance adequate. GitHub’s approach is narrower: it covers Copilot requests only, not agents in general.

The preview arrives a day after GitHub made assisted permissions generally available. In that feature, a model decides which of Copilot’s commands are safe to run unattended, as we reported. Together, the two changes point toward Copilot running with less human supervision, which raises the stakes of the organization-level limits that server-to-server tokens depend on.

What the source does not establish is how the feature behaves at scale. GitHub offers no figures on rate limits, no data on how many requests an installation can make, and no independent testing. The claim that the design helps agents operate reliably at larger scale is GitHub’s own.

Developers who want to try it can start with the two documentation pages GitHub links: server-to-server authentication for the Copilot SDK, and managing GitHub App access to an organization’s Copilot.