Copilot gives automated services an identity of their own

An automated task should not depend on the person who happened to sign in when it was set up. GitHub’s October 27 public preview lets services built with the Copilot SDK authenticate through an organization-installed GitHub App. Requests use an installation token and are attributed to the organization, rather than requiring a signed-in user. Release announcement.

For a team running a recurring coding assistant, that changes who owns the connection and who pays for it. It does not make the assistant a different model or give it unlimited usage. Model choices remain subject to the organization’s policies.

Keep identity, renewal and billing together

The SDK instructions call for a GitHub App with the organization’s Copilot Requests: Read-only permission. The organization must be enabled for this preview. Installation tokens expire after one hour, so a service needs a renewal path. GitHub documents passing the token explicitly to the SDK when disabling discovery of stored user credentials.

This matters for a job that works once and later fails: first distinguish an expired token from a missing permission or disallowed model. GitHub Actions has a separate built-in-token path; copying that setup into an external service is not the same authentication method.

Attribution is not a separate spending limit

GitHub’s administrator guide makes the cost boundary explicit. Read-only permission can consume AI credits. The installation’s organization pays, and you cannot set a budget for one app or installation. A budget configured only to alert also does not stop usage.

An app’s app_client_id appears in AI usage CSV exports, rather than the current AI usage view. That helps answer which integration made the requests, but it is a reporting tool, not a per-app cap. Personal-account and enterprise installations cannot use this method.

For a proposed rollout, begin with one bounded task, confirm the billed organization, exercise token renewal and inspect the CSV attribution before scheduling repeated work. No such request was run for this article. Review the organization’s stop-at-budget setting before enabling automation; a notification after a bill grows is a different control.

Our Copilot model-policy coverage explains inherited model access, while the Terra rollout and usage-cost story helps separate a model choice from the identity making the request.