GitHub Apps can now use Copilot without a signed-in user, and the organization pays

GitHub announced on October 27, 2026, that services and agents built with the GitHub Copilot SDK can make Copilot requests on behalf of an organization without a signed-in user. The feature is in public preview and works through a GitHub App installed on that organization. The organization that owns the installation pays for everything the app uses. GitHub says this keeps an automated service's access and usage from being tied to one person.

How it is set up

An organization creates a GitHub App with the Copilot Requests organization permission set to read-only, then installs it on the organization that should be billed. The service generates a short-lived installation access token and passes it to the SDK through its explicit token option. Installation tokens expire after one hour, so the service has to mint a new one in time and restart the SDK client with it.

In GitHub's examples, useLoggedInUser: false turns off automatic credential discovery, including tokens stored in environment variables such as COPILOT_GITHUB_TOKEN. That keeps the service from quietly falling back to a developer's saved login. Workflows in GitHub Actions keep a separate path, which uses the built-in GITHUB_TOKEN and needs no GitHub App.

Who pays, and what limits apply

Usage is attributed and billed to the organization that owns the installation, and that organization's model policies, budgets, and spending controls apply. The app can call only the models the organization's Copilot policy allows. The method is limited to apps installed on an organization, so installations on personal accounts and on enterprises cannot use it.

GitHub's documentation is explicit that read-only does not mean free. The permission authorizes the app to make requests that consume the organization's AI credits. A budget cannot be set for a single app or installation, and a budget that only sends alerts does not stop spending. To block requests at the limit, the organization has to turn on Stop usage when budget limit is reached.

Tracking and stopping an app

Organization owners can review which apps have access and find each app's usage in the AI usage CSV report, through the app_client_id field. That attribution appears only in the CSV export, not in the AI usage view on GitHub. Suspending or uninstalling the app stops its Copilot requests, but it also cuts the installation's access to every other resource in the organization.