GitHub's announcement confirms organization-scoped GitHub App authentication for the Copilot SDK in public preview, including token, permission, billing, attribution and revocation behavior.
GitHub adds workload identity to the Copilot SDK
2026-10-28Verified announcementTRIAL
GitHub Copilot SDK can now authenticate GitHub Apps installed on organizations without borrowing a signed-in user's credentials. The public preview uses short-lived installation tokens and a read-only Copilot Requests permission. Usage is billed to the organization and remains subject to its model policies, budgets and spending controls.
Availability: public preview for GitHub Apps installed on organizations
What this means for you
For teams building unattended coding services, workload-owned identity removes a fragile user credential from the control plane. The preview still needs revocation, attribution and budget-exhaustion tests before it can carry production automation.
Evidence & related material
Technical details & scores
| Availability | public preview for GitHub Apps installed on organizations |
|---|---|
| Authentication | short-lived installation access token; read-only Copilot Requests organization permission |
| Governance | organization model policies, budgets, spending controls, billing and AI usage CSV attribution apply |
| Revocation | organization owners can suspend or uninstall the GitHub App |
| Time Basis | GitHub changelog RSS published 2026-10-27T21:36:55Z |
Technical impact 3
Engineering value 4
Adoption signal 3
Maturity 2
Verification cost 2
Risk 3