Copilot adds server authentication: GitHub Apps use organization budgets

Background work can use an application identity

GitHub announced server-to-server authentication for Copilot on October 27, 2026 in public preview. A GitHub App installed on an organization can use its own installation access token for Copilot requests without a person signing in interactively. New SDK and administration guidance explains the path.

This October 28 report concerns a potential integration route for issue assistants, change preparation or internal background tasks. It does not establish customer demand, authorize unsupervised deployment or guarantee that preview details will remain unchanged.

Read-only is a permission label, not a no-cost promise

The app needs the organization Copilot Requests permission set to Read-only. In this context that authorizes requests consuming the organization’s AI credits. Reviewers must identify the app, its purpose and the spending owner; the label does not mean that it merely views information or cannot incur charges.

The documented path applies to organization installations, not personal-account or enterprise installations. Organization model policies still apply. The administration guide is for organization owners with Copilot Business or Enterprise, not a claim that every free account can enable the feature.

This is different from user-identity authentication and from GitHub Actions using GITHUB_TOKEN. An Actions workflow configuration does not substitute for GitHub App authorization. The policy allowing Copilot CLI use billed to the organization is not required for this installation-token path.

Token expiry needs an operational design

Installation access tokens last one hour. Long-running jobs and services must manage reissuance and the appropriate SDK client/runtime lifecycle before expiry. A short-lived token stored as a permanent configuration value is not a complete implementation.

Friday Works recommends separating the app’s private key from processes handling untrusted content, using least privilege and recording issuance, expiry and revocation without logging secrets. Failure to refresh should produce a controlled error rather than silently falling back to a personal credential.

These are proposed pilot practices, not a description of a deployed Friday Works service. Check the actual SDK and runtime. Automatic refresh behavior in another tool cannot be assumed to apply here.

A spending control must explain how requests stop

Usage counts against the organization’s Copilot budget; the documentation says there is no separate budget for one app or installation. An alerts-only budget does not stop spending. A hard stop requires checking Stop usage when budget limit is reached. Do not present an email alert as a cap.

App attribution is in CSV reports through app_client_id, not the AI usage view. Administrators can match it with client_id in the installation list to identify app_slug. Historical, user-attributed, Actions and certain GitHub-owned app usage can leave that field empty; an empty value is not evidence of zero usage.

Suspending or uninstalling an installation blocks its Copilot requests and its other access to organizational resources. Understand those dependencies before using the action as an emergency stop.

Keep the first experiment small and auditable

Friday Works suggests an internal task that reads sample data and produces a human-reviewed draft, without automatically editing or merging code. Record request counts, authentication failures, actual cost and report attribution. Deliberately test near-expiry behavior and the approved stop mechanism in a controlled environment.

The pilot passes when identity, spending and output are traceable, stopping works as designed and no personal credentials are needed. Broad permissions, unclear spending stops or untraceable usage are reasons to revise the design before customer exposure. The pictured official documentation concerns the new capability; it is not a billing dashboard or evidence of a running Friday Works installation.