From the source
GitHub Copilot now supports server-to-server authentication for GitHub Apps installed on organizations, in public preview, so services and agents built with the Copilot SDK can act for an organization without a signed-in user's credentials.
- GitHub says the workload-owned identity lets agents and automated services run reliably at larger scale without tying their authentication or usage to individual users.
- Developers give a GitHub App the read-only Copilot Requests organization permission, install it on an organization, and pass a short-lived installation access token to the Copilot SDK.
- Usage is attributed and billed to the organization that owns the installation, and that organization's model policies, budgets and spending controls apply.
- Organization owners can review which apps have access, spot app-attributed usage in AI usage CSV reports through the app_client_id field, and cut off an app by suspending or uninstalling it.
