Copilot SDK can authenticate as a GitHub App

GitHub's changelog for 27 October 2026 says GitHub Copilot now supports server-to-server authentication for GitHub Apps installed on organizations, in public preview. Services and agents built with the GitHub Copilot SDK can make requests on behalf of an organization without a signed-in user's credentials.

A developer gives a GitHub App the read-only Copilot Requests organization permission, installs the app on an organization, and passes a short-lived installation access token to the Copilot SDK. Usage is attributed and billed to the organization that owns the installation. That organization's model policies, budgets, and spending controls apply. Organization owners can review which apps have access, find app-attributed usage in AI usage CSV reports under the app_client_id field, and stop an app by suspending or uninstalling it.

Who it's for: someone building an organization-owned agent or service on the Copilot SDK, and the owner who grants or revokes that app.

Fits: Best for Vibe Coding. GitHub Copilot stays fourth. This is how an app authenticates. It does not change the edit loop that keeps Cursor first. The verdict is unchanged.