Author: Nadali. Prepared using AI.
On October 27, GitHub announced a public preview of server-to-server Copilot authentication. GitHub Apps installed in an organization can make requests on its behalf without a user’s credentials.
Who should care
Small-business owners approving integrations for their development team or contractor. The Copilot Requests permission is labelled Read-only, but requests consume the organization’s AI credits: the label does not mean free usage.
Availability and limits
The administrator guide addresses organization owners with Copilot Business or Enterprise. Organization installations are supported, not personal-account or enterprise installations. This is a preview and may change.
The technical instructions describe short-lived installation tokens: they last one hour. Refreshing them is the responsible developer’s task.
Checks before approval
Our editorial recommendation: ask the person responsible to document the app’s purpose, expected usage and who will monitor spending.
There is no separate budget for each app. Review the organization’s budget: alerts alone do not stop consumption; stopping it requires Stop usage when budget limit is reached.
Bottom line: approve spending oversight as well as access. This is a separate change from the Copilot feature-default policies covered earlier.
Nadali checked the primary sources on October 28, 2026; we have not tested an app or credit charges. The cover is a conceptual AI illustration, not GitHub’s interface.
