{"meta":{"title":"Authentication","intro":"The GitHub Copilot SDK supports multiple authentication methods to fit different use cases. Choose the method that best matches your deployment scenario.","product":"GitHub Copilot","breadcrumbs":[{"href":"/en/copilot","title":"GitHub Copilot"},{"href":"/en/copilot/how-tos","title":"How-tos"},{"href":"/en/copilot/how-tos/copilot-sdk","title":"Copilot SDK"},{"href":"/en/copilot/how-tos/copilot-sdk/auth","title":"Authentication"},{"href":"/en/copilot/how-tos/copilot-sdk/auth/authenticate","title":"Authenticate"}],"documentType":"article"},"body":"# Authentication\n\nThe GitHub Copilot SDK supports multiple authentication methods to fit different use cases. Choose the method that best matches your deployment scenario.\n\n\n\n\n\n## Authentication methods\n\n| Method | Use Case | Copilot Subscription Required |\n| ----------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ | -------------------------------------------------- |\n| [GitHub Signed-in User](#github-signed-in-user) | Interactive apps where users sign in with GitHub | Yes |\n| [GitHub OAuth App](#github-oauth-app) | Apps acting on behalf of users via OAuth | Yes |\n| [Environment Variables](#environment-variables) | CI/CD, automation, server-to-server | Yes |\n| [Server-to-server authentication](/en/copilot/how-tos/copilot-sdk/auth/server-to-server-tokens) | Organization-attributed automation and direct organization billing | No user subscription; organization policy required |\n| [BYOK (bring your own key)](/en/copilot/how-tos/copilot-sdk/auth/byok) | Using your own API keys (Microsoft Foundry, OpenAI, and more) | No |\n\n## GitHub signed-in user\n\nThis is the default authentication method when running the Copilot CLI interactively. Users authenticate via GitHub OAuth device flow, and the SDK uses their stored credentials.\n\n**How it works:**\n\n1. User runs `copilot` CLI and signs in via GitHub OAuth\n2. Credentials are stored securely in the system keychain\n3. SDK automatically uses stored credentials\n\n**SDK Configuration:**\n\n
\n
.NET
\n\n```csharp\nusing GitHub.Copilot;\n\n// Default: uses logged-in user credentials\nawait using CopilotClient client = new();\n```\n\n
\n\n
Go
\n\n```golang\nimport copilot \"github.com/github/copilot-sdk/go\"\n\n// Default: uses logged-in user credentials\nclient := copilot.NewClient(nil)\n```\n\n
\n\n
Java
\n\n```java\nimport com.github.copilot.CopilotClient;\n\n// Default: uses logged-in user credentials\nvar client = new CopilotClient();\nclient.start().get();\n```\n\n
\n\n
Python
\n\n```python\nfrom copilot import CopilotClient\n\n# Default: uses logged-in user credentials\nclient = CopilotClient()\nawait client.start()\n```\n\n
\n\n
Rust
\n\n```rust\nuse github_copilot_sdk::{Client, ClientOptions};\n\n// Default: uses logged-in user credentials\nlet client = Client::start(ClientOptions::default()).await?;\n```\n\n
\n\n
TypeScript
\n\n```typescript\nimport { CopilotClient } from \"@github/copilot-sdk\";\n\n// Default: uses logged-in user credentials\nconst client = new CopilotClient();\n```\n\n
\n\n
\n\n**When to use:**\n\n* Desktop applications where users interact directly\n* Development and testing environments\n* Any scenario where a user can sign in interactively\n\n## GitHub OAuth App\n\nUse an OAuth GitHub App to authenticate users through your application and pass their credentials to the SDK. This enables your application to make Copilot API requests on behalf of users who authorize your app.\n\n**How it works:**\n\n1. User authorizes your OAuth GitHub App\n2. Your app receives a user access token (`gho_` or `ghu_` prefix)\n3. Pass the token to the SDK through its client configuration\n\n**SDK Configuration:**\n\n
\n
.NET
\n\n```csharp\nusing GitHub.Copilot;\n\nawait using var client = new CopilotClient(new CopilotClientOptions\n{\n GitHubToken = userAccessToken, // Token from OAuth flow\n UseLoggedInUser = false, // Don't use stored CLI credentials\n});\n```\n\n
\n\n
Go
\n\n```golang\nimport copilot \"github.com/github/copilot-sdk/go\"\n\nclient := copilot.NewClient(&copilot.ClientOptions{\n GitHubToken: userAccessToken, // Token from OAuth flow\n UseLoggedInUser: copilot.Bool(false), // Don't use stored CLI credentials\n})\n```\n\n
\n\n
Java
\n\n\n\n```java\nimport com.github.copilot.CopilotClient;\nimport com.github.copilot.rpc.*;\n\nvar client = new CopilotClient(new CopilotClientOptions()\n .setGitHubToken(userAccessToken) // Token from OAuth flow\n .setUseLoggedInUser(false) // Don't use stored CLI credentials\n);\nclient.start().get();\n```\n\n
\n\n
Python
\n\n```python\nfrom copilot import CopilotClient\n\nclient = CopilotClient({\n \"github_token\": user_access_token, # Token from OAuth flow\n \"use_logged_in_user\": False, # Don't use stored CLI credentials\n})\nawait client.start()\n```\n\n
\n\n
Rust
\n\n```rust\nuse github_copilot_sdk::{Client, ClientOptions};\n\nlet client = Client::start(\n ClientOptions::default()\n .with_github_token(user_access_token)\n .with_use_logged_in_user(false),\n).await?;\n```\n\n
\n\n
TypeScript
\n\n```typescript\nimport { CopilotClient } from \"@github/copilot-sdk\";\n\nconst client = new CopilotClient({\n gitHubToken: userAccessToken, // Token from OAuth flow\n useLoggedInUser: false, // Don't use stored CLI credentials\n});\n```\n\n
\n\n
\n\n**Supported token types:**\n\n* `gho_` - OAuth user access tokens\n* `ghu_` - GitHub App user access tokens\n* `github_pat_` - Fine-grained personal access tokens\n\n**Not supported:**\n\n* `ghp_` - Classic personal access tokens (deprecated)\n\n**When to use:**\n\n* Web applications where users sign in via GitHub\n* SaaS applications building on top of Copilot\n* Any multi-user application where you need to make requests on behalf of different users\n\nFor more information, see [GitHub OAuth setup](/en/copilot/how-tos/copilot-sdk/setup/github-oauth).\n\n## Environment variables\n\nFor automation, CI/CD pipelines, and server-to-server scenarios, you can authenticate using environment variables.\n\nFor organization-attributed automation that should not use a user's personal access token, see [Server-to-server authentication](/en/copilot/how-tos/copilot-sdk/auth/server-to-server-tokens).\n\n**Supported environment variables (in priority order):**\n\n1. `COPILOT_GITHUB_TOKEN` - Recommended for explicit Copilot usage\n2. `GH_TOKEN` - GitHub CLI compatible\n3. `GITHUB_TOKEN` - GitHub Actions compatible\n\n**How it works:**\n\n1. Set one of the supported environment variables with a valid token\n2. The SDK automatically detects and uses the token\n\n**SDK Configuration:**\n\nNo code changes needed—the SDK automatically detects environment variables:\n\n
\n
.NET
\n\n```csharp\nusing GitHub.Copilot;\n\n// Token is read from environment variable automatically\nawait using CopilotClient client = new();\n```\n\n
\n\n
Go
\n\n```golang\nimport copilot \"github.com/github/copilot-sdk/go\"\n\n// Token is read from environment variable automatically\nclient := copilot.NewClient(nil)\n```\n\n
\n\n
Java
\n\n```java\nimport com.github.copilot.CopilotClient;\n\n// Token is read from environment variable automatically\nvar client = new CopilotClient();\nclient.start().get();\n```\n\n
\n\n
Python
\n\n```python\nfrom copilot import CopilotClient\n\n# Token is read from environment variable automatically\nclient = CopilotClient()\nawait client.start()\n```\n\n
\n\n
Rust
\n\n```rust\nuse github_copilot_sdk::{Client, ClientOptions};\n\n// Token is read from environment variable automatically\nlet client = Client::start(ClientOptions::default()).await?;\n```\n\n
\n\n
TypeScript
\n\n```typescript\nimport { CopilotClient } from \"@github/copilot-sdk\";\n\n// Token is read from environment variable automatically\nconst client = new CopilotClient();\n```\n\n
\n\n
\n\n**When to use:**\n\n* CI/CD pipelines (GitHub Actions, Jenkins, and more)\n* Automated testing\n* Server-side applications with service accounts\n* Development when you don't want to use interactive login\n\n## BYOK (bring your own key)\n\nBYOK allows you to use your own API keys from model providers like Microsoft Foundry, OpenAI, or Anthropic. This bypasses GitHub Copilot authentication entirely.\n\n**Key benefits:**\n\n* No GitHub Copilot subscription required\n* Use enterprise model deployments\n* Direct billing with your model provider\n* Support for Microsoft Foundry, OpenAI, Anthropic, and OpenAI-compatible endpoints\n\n**See the [BYOK (bring your own key)](/en/copilot/how-tos/copilot-sdk/auth/byok) for complete details**, including:\n\n* Microsoft Foundry setup\n* Provider configuration options\n* Limitations and considerations\n* Complete code examples\n\n## Authentication priority\n\nWhen multiple authentication methods are available, the SDK uses them in this priority order:\n\n1. **Explicit `gitHubToken`** - Token passed directly to the SDK client or session configuration\n2. **Direct API token** - `GITHUB_COPILOT_API_TOKEN` with `COPILOT_API_URL`\n3. **Environment variable tokens** - `COPILOT_GITHUB_TOKEN` → `GH_TOKEN` → `GITHUB_TOKEN`\n4. **Stored OAuth credentials** - From previous `copilot` CLI login\n5. **GitHub CLI** - `gh auth` credentials\n\nFor multi-user server mode, pass a per-session `gitHubToken` so each session runs with the correct GitHub identity; see [Multi-tenancy and server deployments](/en/copilot/how-tos/copilot-sdk/setup/multi-tenancy).\n\n## Disabling auto-login\n\nTo prevent the SDK from automatically using stored credentials or `gh` CLI auth, configure it to disable logged-in-user fallback:\n\n
\n
.NET
\n\n```csharp\nawait using var client = new CopilotClient(new CopilotClientOptions\n{\n UseLoggedInUser = false, // Only use explicit tokens\n});\n```\n\n
\n\n
Go
\n\n```golang\nclient := copilot.NewClient(&copilot.ClientOptions{\n UseLoggedInUser: copilot.Bool(false), // Only use explicit tokens\n})\n```\n\n
\n\n
Java
\n\n```java\nimport com.github.copilot.CopilotClient;\nimport com.github.copilot.rpc.*;\n\nvar client = new CopilotClient(new CopilotClientOptions()\n .setUseLoggedInUser(false) // Only use explicit tokens\n);\nclient.start().get();\n```\n\n
\n\n
Python
\n\n```python\nclient = CopilotClient({\n \"use_logged_in_user\": False, # Only use explicit tokens\n})\n```\n\n
\n\n
Rust
\n\n```rust\nuse github_copilot_sdk::{Client, ClientOptions};\n\nlet client = Client::start(\n ClientOptions::default().with_use_logged_in_user(false),\n).await?;\n```\n\n
\n\n
TypeScript
\n\n```typescript\nconst client = new CopilotClient({\n useLoggedInUser: false, // Only use explicit tokens\n});\n```\n\n
\n\n
\n\n## Next steps\n\n* [BYOK (bring your own key)](/en/copilot/how-tos/copilot-sdk/auth/byok) - Learn how to use your own API keys\n* [Build your first Copilot-powered app](/en/copilot/how-tos/copilot-sdk/getting-started) - Build your first Copilot-powered app\n* [Using MCP servers with the GitHub Copilot SDK](/en/copilot/how-tos/copilot-sdk/features/mcp) - Connect to external tools"}