GitHub Copilot 现已支持服务器到服务器（Server-to-Server）身份验证公测

GitHub Copilot 现已针对安装在组织（Organization）中的 GitHub App 支持服务器到服务器（Server-to-Server）身份验证，目前已进入公开预览（Public Preview）阶段。基于 GitHub Copilot SDK 构建的服务和 Agent 现在可以代表组织发起请求，而无需依赖登录用户的个人凭证。这种属于工作负载自身的独立身份（Workload-owned identity），有助于 Agent 和自动化服务在更大规模下稳定可靠地运行，避免将其身份验证或使用额度与个人用户绑定。

开发者可以为 GitHub App 授予只读的 Copilot Requests 组织权限，将该应用安装到对应组织中，并向 Copilot SDK 传入短期有效的安装访问令牌（installation access token）。所产生的用量将归属并计费至拥有该安装的组织，同时适用该组织的模型策略、预算及支出控制规则。

组织所有者可以审查哪些应用具有访问权限，通过 AI 用量 CSV 报表中的 app_client_id 字段精确识别由各应用产生的使用明细，并能通过挂起或卸载应用随时终止其访问权限。

如需开始使用，请参阅 GitHub Copilot SDK 的服务器到服务器身份验证 与 管理 GitHub App 对组织 Copilot 的访问权限。

GitHub Copilot now supports server-to-server authentication for GitHub Apps installed on organizations, available in public preview. Services and agents built with the GitHub Copilot SDK can now make requests on behalf of an organization without relying on a signed-in user’s credentials. This workload-owned identity helps agents and automated services operate reliably at larger scale without tying their authentication or usage to individual users.

Developers can give a GitHub App the read-only Copilot Requests organization permission, install the app on an organization, and pass a short-lived installation access token to the Copilot SDK. Usage is attributed and billed to the organization that owns the installation. The organization’s model policies, budgets, and spending controls apply.

Organization owners can review which apps have access, identify app-attributed usage in AI usage CSV reports using the app_client_id field, and stop an app’s access by suspending or uninstalling it.

To get started, see server-to-server authentication for the GitHub Copilot SDK and managing GitHub App access to your organization’s Copilot.