GitHub Apps can now make Copilot SDK requests for an organisation without a signed-in user. The preview changes who authenticates, not whether usage costs money.
An automated service no longer needs a person’s login
GitHub’s 27 October release introduces server-to-server authentication for Copilot SDK services using an organisation-installed GitHub App. The app can make model requests with an installation token instead of a signed-in employee’s credentials. This is a public preview. It is not an announcement that every account or deployment already has access.
Read-only is a permission label, not a spending limit
The organisation’s Copilot Requests permission is labelled Read-only, but requests still consume its AI credits. Organisation model policies and spending controls apply. GitHub’s administration guide says an individual app or installation cannot have its own separate budget. A budget that only sends alerts does not stop further spending; the stop-usage setting is a separate control. Check the actual organisation settings before approving an app.
Match the identity to the workload
The SDK documentation describes one-hour installation tokens for services outside GitHub Actions. GitHub Actions has a different path using its built-in token and its own policies. Do not assume that instructions for one path apply to the other. For app-attributed usage, GitHub points owners to the app_client_id field in CSV reports. Suspending or uninstalling the app stops its installation access, including access to other organisation resources.
A small evaluation before a wider rollout
A useful first evaluation would be a routine task on a disposable repository, with an administrator watching the organisation’s usage report. Record which app ran the task, the requested model, the accepted result and the billed usage. Then confirm how the app would be stopped. This is a suggested evaluation, not a HubAI hands-on result. The accompanying artwork is conceptual, not a screenshot of the product.
HUBAI VIEWCheck the app owner, organisation budget and revocation route before giving an automated service access.
Buyer decision signal: GitHub public preview · announced 27 October 2026
What to verify next
1Confirm the organisation and app owner.
2Check preview access and allowed models.
3Separate alert-only budgets from stop-usage controls.
4Review app-attributed usage and the revocation route.
Read the evidence
Capabilities, availability and prices can change. HubAI keeps analysis separate from the underlying official material.
01GitHub release · 27 October 2026Open source ↗02GitHub Docs · server-to-server authentication · checked 28 OctoberOpen source ↗03GitHub Docs · organisation app access and billing · checked 28 OctoberOpen source ↗
Code AI
Code AI
Code AI