{"meta":{"title":"Authentication","intro":"GitHub Copilot SDK 支持多种身份验证方法以适应不同的用例。 选择最适合部署方案的方法。","product":"GitHub Copilot","breadcrumbs":[{"href":"/zh/copilot","title":"GitHub Copilot"},{"href":"/zh/copilot/how-tos","title":"操作方法"},{"href":"/zh/copilot/how-tos/copilot-sdk","title":"Copilot SDK"},{"href":"/zh/copilot/how-tos/copilot-sdk/auth","title":"Authentication"},{"href":"/zh/copilot/how-tos/copilot-sdk/auth/authenticate","title":"Authenticate"}],"documentType":"article"},"body":"# Authentication\n\nGitHub Copilot SDK 支持多种身份验证方法以适应不同的用例。 选择最适合部署方案的方法。\n\n<!-- markdownlint-disable GHD046 GHD005 -->\n\n<!-- Suppressed: GHD046 (outdated release terminology), GHD005 (hardcoded data variable) -->\n\n## 身份验证方法\n\n| 方法                                                                          | 用例                                       | 需要Copilot订阅  |\n| --------------------------------------------------------------------------- | ---------------------------------------- | ------------ |\n| [GitHub已登录用户](#github-signed-in-user)                                       | 用户使用GitHub登录的交互式应用                       | 是            |\n| [GitHub OAuth 应用](#github-oauth-app)                                        | 通过 OAuth 代表用户运行的应用                       | 是            |\n| [环境变量](#environment-variables)                                              | CI/CD、自动化、服务器到服务器                        | 是            |\n| [服务器到服务器身份验证](/zh/copilot/how-tos/copilot-sdk/auth/server-to-server-tokens) | 归属于组织的自动化和直接向组织计费                        | 无用户订阅;需要组织策略 |\n| [BYOK （自带密钥）](/zh/copilot/how-tos/copilot-sdk/auth/byok)                    | 使用自己的 API 密钥（Microsoft Foundry、OpenAI 等） | 否            |\n\n## GitHub 登录用户\n\n这是以交互方式运行 Copilot CLI 时的默认身份验证方法。 用户通过 GitHub OAuth 设备流进行身份验证，SDK 使用其存储的凭据。\n\n**工作原理**：\n\n1. 用户运行 `copilot` CLI 并通过 GitHub OAuth 登录\n2. 凭据安全地存储在系统密钥链中\n3. SDK 自动使用存储的凭据\n\n**SDK 配置：**\n\n<div class=\"ghd-codetabs\">\n<div class=\"ghd-codetab\" data-lang=\"dotnet\" data-label=\".NET\"><div class=\"ghd-codetab-fallback-label\" role=\"heading\" aria-level=\"3\">.NET</div>\n\n```csharp\nusing GitHub.Copilot;\n\n// Default: uses logged-in user credentials\nawait using CopilotClient client = new();\n```\n\n</div>\n\n<div class=\"ghd-codetab\" data-lang=\"go\" data-label=\"Go\"><div class=\"ghd-codetab-fallback-label\" role=\"heading\" aria-level=\"3\">Go</div>\n\n```golang\nimport copilot \"github.com/github/copilot-sdk/go\"\n\n// Default: uses logged-in user credentials\nclient := copilot.NewClient(nil)\n```\n\n</div>\n\n<div class=\"ghd-codetab\" data-lang=\"java\" data-label=\"Java\"><div class=\"ghd-codetab-fallback-label\" role=\"heading\" aria-level=\"3\">Java</div>\n\n```java\nimport com.github.copilot.CopilotClient;\n\n// Default: uses logged-in user credentials\nvar client = new CopilotClient();\nclient.start().get();\n```\n\n</div>\n\n<div class=\"ghd-codetab\" data-lang=\"python\" data-label=\"Python\"><div class=\"ghd-codetab-fallback-label\" role=\"heading\" aria-level=\"3\">Python</div>\n\n```python\nfrom copilot import CopilotClient\n\n# Default: uses logged-in user credentials\nclient = CopilotClient()\nawait client.start()\n```\n\n</div>\n\n<div class=\"ghd-codetab\" data-lang=\"rust\" data-label=\"Rust\"><div class=\"ghd-codetab-fallback-label\" role=\"heading\" aria-level=\"3\">Rust</div>\n\n```rust\nuse github_copilot_sdk::{Client, ClientOptions};\n\n// Default: uses logged-in user credentials\nlet client = Client::start(ClientOptions::default()).await?;\n```\n\n</div>\n\n<div class=\"ghd-codetab\" data-lang=\"typescript\" data-label=\"TypeScript\"><div class=\"ghd-codetab-fallback-label\" role=\"heading\" aria-level=\"3\">TypeScript</div>\n\n```typescript\nimport { CopilotClient } from \"@github/copilot-sdk\";\n\n// Default: uses logged-in user credentials\nconst client = new CopilotClient();\n```\n\n</div>\n\n</div>\n\n**何时使用**：\n\n* 用户直接交互的桌面应用程序\n* 开发和测试环境\n* 用户可以以交互方式登录的任何方案\n\n## GitHub OAuth 应用\n\n使用 OAuth GitHub 应用通过应用程序对用户进行身份验证，并将其凭据传递给 SDK。 这使应用程序能够代表授权应用的用户发出Copilot API 请求。\n\n**工作原理**：\n\n1. 用户已授权您的 OAuth GitHub 应用\n2. 你的应用接收用户访问令牌（`gho_` 或 `ghu_` 前缀）\n3. 通过其客户端配置将令牌传递到 SDK\n\n**SDK 配置：**\n\n<div class=\"ghd-codetabs\">\n<div class=\"ghd-codetab\" data-lang=\"dotnet\" data-label=\".NET\"><div class=\"ghd-codetab-fallback-label\" role=\"heading\" aria-level=\"3\">.NET</div>\n\n```csharp\nusing GitHub.Copilot;\n\nawait using var client = new CopilotClient(new CopilotClientOptions\n{\n    GitHubToken = userAccessToken,     // Token from OAuth flow\n    UseLoggedInUser = false,           // Don't use stored CLI credentials\n});\n```\n\n</div>\n\n<div class=\"ghd-codetab\" data-lang=\"go\" data-label=\"Go\"><div class=\"ghd-codetab-fallback-label\" role=\"heading\" aria-level=\"3\">Go</div>\n\n```golang\nimport copilot \"github.com/github/copilot-sdk/go\"\n\nclient := copilot.NewClient(&copilot.ClientOptions{\n    GitHubToken:       userAccessToken,      // Token from OAuth flow\n    UseLoggedInUser:   copilot.Bool(false),  // Don't use stored CLI credentials\n})\n```\n\n</div>\n\n<div class=\"ghd-codetab\" data-lang=\"java\" data-label=\"Java\"><div class=\"ghd-codetab-fallback-label\" role=\"heading\" aria-level=\"3\">Java</div>\n\n<!-- docs-validate: skip -->\n\n```java\nimport com.github.copilot.CopilotClient;\nimport com.github.copilot.rpc.*;\n\nvar client = new CopilotClient(new CopilotClientOptions()\n    .setGitHubToken(userAccessToken)  // Token from OAuth flow\n    .setUseLoggedInUser(false)        // Don't use stored CLI credentials\n);\nclient.start().get();\n```\n\n</div>\n\n<div class=\"ghd-codetab\" data-lang=\"python\" data-label=\"Python\"><div class=\"ghd-codetab-fallback-label\" role=\"heading\" aria-level=\"3\">Python</div>\n\n```python\nfrom copilot import CopilotClient\n\nclient = CopilotClient({\n    \"github_token\": user_access_token,  # Token from OAuth flow\n    \"use_logged_in_user\": False,        # Don't use stored CLI credentials\n})\nawait client.start()\n```\n\n</div>\n\n<div class=\"ghd-codetab\" data-lang=\"rust\" data-label=\"Rust\"><div class=\"ghd-codetab-fallback-label\" role=\"heading\" aria-level=\"3\">Rust</div>\n\n```rust\nuse github_copilot_sdk::{Client, ClientOptions};\n\nlet client = Client::start(\n    ClientOptions::default()\n        .with_github_token(user_access_token)\n        .with_use_logged_in_user(false),\n).await?;\n```\n\n</div>\n\n<div class=\"ghd-codetab\" data-lang=\"typescript\" data-label=\"TypeScript\"><div class=\"ghd-codetab-fallback-label\" role=\"heading\" aria-level=\"3\">TypeScript</div>\n\n```typescript\nimport { CopilotClient } from \"@github/copilot-sdk\";\n\nconst client = new CopilotClient({\n    gitHubToken: userAccessToken,  // Token from OAuth flow\n    useLoggedInUser: false,        // Don't use stored CLI credentials\n});\n```\n\n</div>\n\n</div>\n\n**支持的令牌类型：**\n\n* `gho_` - OAuth 用户访问令牌\n* `ghu_` - GitHub应用用户访问令牌\n* `github_pat_` - 细粒度个人访问令牌\n\n**不支持：**\n\n* `ghp_` - 经典个人访问令牌（已弃用）\n\n**何时使用**：\n\n* 用户通过GitHub登录的 Web 应用程序\n* 基于 Copilot 构建的 SaaS 应用程序\n* 需要代表不同用户发出请求的任何多用户应用程序\n\n有关详细信息，请参阅“[GitHub OAuth 设置](/zh/copilot/how-tos/copilot-sdk/setup/github-oauth)”。\n\n## 环境变量\n\n对于自动化、CI/CD 管道和服务器到服务器方案，可以使用环境变量进行身份验证。\n\n有关不应使用用户个人访问令牌的组织特性化自动化，请参阅 [服务器到服务器身份验证](/zh/copilot/how-tos/copilot-sdk/auth/server-to-server-tokens)。\n\n**支持的环境变量（按优先级顺序）：**\n\n1. `COPILOT_GITHUB_TOKEN` - 推荐用于显式 Copilot 使用场景\n2. `GH_TOKEN` - GitHub CLI 兼容\n3. `GITHUB_TOKEN` - GitHub Actions兼容\n\n**工作原理**：\n\n1. 使用有效令牌设置受支持的环境变量之一\n2. SDK 会自动检测和使用令牌\n\n**SDK 配置：**\n\n无需更改代码 - SDK 会自动检测环境变量：\n\n<div class=\"ghd-codetabs\">\n<div class=\"ghd-codetab\" data-lang=\"dotnet\" data-label=\".NET\"><div class=\"ghd-codetab-fallback-label\" role=\"heading\" aria-level=\"3\">.NET</div>\n\n```csharp\nusing GitHub.Copilot;\n\n// Token is read from environment variable automatically\nawait using CopilotClient client = new();\n```\n\n</div>\n\n<div class=\"ghd-codetab\" data-lang=\"go\" data-label=\"Go\"><div class=\"ghd-codetab-fallback-label\" role=\"heading\" aria-level=\"3\">Go</div>\n\n```golang\nimport copilot \"github.com/github/copilot-sdk/go\"\n\n// Token is read from environment variable automatically\nclient := copilot.NewClient(nil)\n```\n\n</div>\n\n<div class=\"ghd-codetab\" data-lang=\"java\" data-label=\"Java\"><div class=\"ghd-codetab-fallback-label\" role=\"heading\" aria-level=\"3\">Java</div>\n\n```java\nimport com.github.copilot.CopilotClient;\n\n// Token is read from environment variable automatically\nvar client = new CopilotClient();\nclient.start().get();\n```\n\n</div>\n\n<div class=\"ghd-codetab\" data-lang=\"python\" data-label=\"Python\"><div class=\"ghd-codetab-fallback-label\" role=\"heading\" aria-level=\"3\">Python</div>\n\n```python\nfrom copilot import CopilotClient\n\n# Token is read from environment variable automatically\nclient = CopilotClient()\nawait client.start()\n```\n\n</div>\n\n<div class=\"ghd-codetab\" data-lang=\"rust\" data-label=\"Rust\"><div class=\"ghd-codetab-fallback-label\" role=\"heading\" aria-level=\"3\">Rust</div>\n\n```rust\nuse github_copilot_sdk::{Client, ClientOptions};\n\n// Token is read from environment variable automatically\nlet client = Client::start(ClientOptions::default()).await?;\n```\n\n</div>\n\n<div class=\"ghd-codetab\" data-lang=\"typescript\" data-label=\"TypeScript\"><div class=\"ghd-codetab-fallback-label\" role=\"heading\" aria-level=\"3\">TypeScript</div>\n\n```typescript\nimport { CopilotClient } from \"@github/copilot-sdk\";\n\n// Token is read from environment variable automatically\nconst client = new CopilotClient();\n```\n\n</div>\n\n</div>\n\n**何时使用**：\n\n* CI/CD 管道（GitHub Actions、Jenkins 等）\n* 自动测试\n* 具有服务帐户的服务器端应用程序\n* 在不想使用交互式登录时进行开发\n\n## BYOK （自带密钥）\n\nBYOK 允许你从模型提供程序（如 Microsoft Foundry、OpenAI 或 Anthropic）使用自己的 API 密钥。 这会完全绕过GitHub Copilot身份验证。\n\n**主要优势：**\n\n* 无需GitHub Copilot订阅\n* 使用企业模型部署\n* 使用模型提供商进行直接计费\n* 支持 Microsoft Foundry、OpenAI、Anthropic 以及与 OpenAI 兼容的端点\n\n**有关完整详细信息，请参阅 [BYOK （自带密钥）](/zh/copilot/how-tos/copilot-sdk/auth/byok)**，包括：\n\n* Microsoft Foundry 设置\n* 提供程序配置选项\n* 限制和注意事项\n* 完整代码示例\n\n## 身份验证优先级\n\n当有多个身份验证方法可用时，SDK 会按以下优先级顺序使用这些方法：\n\n1. **显式 `gitHubToken`** - 直接传递给 SDK 客户端或会话配置的令牌\n2. **直接 API 令牌** - `GITHUB_COPILOT_API_TOKEN`，搭配 `COPILOT_API_URL` 使用\n3. **环境变量令牌** - `COPILOT_GITHUB_TOKEN``GH_TOKEN` →→`GITHUB_TOKEN`\n4. **已存储的 OAuth 凭据** - 来自之前的 `copilot` CLI 登录\n5. **GitHub CLI** - `gh auth` 凭据\n\n对于多用户服务器模式，请传递每会话`gitHubToken`，以便每个会话都使用正确的GitHub标识运行;请参阅 [多租户与服务器部署](/zh/copilot/how-tos/copilot-sdk/setup/multi-tenancy)。\n\n## 禁用自动登录\n\n若要防止 SDK 自动使用已存储的凭据或 `gh` CLI 身份验证，请将其配置为禁用已登录用户回退机制：\n\n<div class=\"ghd-codetabs\">\n<div class=\"ghd-codetab\" data-lang=\"dotnet\" data-label=\".NET\"><div class=\"ghd-codetab-fallback-label\" role=\"heading\" aria-level=\"3\">.NET</div>\n\n```csharp\nawait using var client = new CopilotClient(new CopilotClientOptions\n{\n    UseLoggedInUser = false,  // Only use explicit tokens\n});\n```\n\n</div>\n\n<div class=\"ghd-codetab\" data-lang=\"go\" data-label=\"Go\"><div class=\"ghd-codetab-fallback-label\" role=\"heading\" aria-level=\"3\">Go</div>\n\n```golang\nclient := copilot.NewClient(&copilot.ClientOptions{\n    UseLoggedInUser: copilot.Bool(false),  // Only use explicit tokens\n})\n```\n\n</div>\n\n<div class=\"ghd-codetab\" data-lang=\"java\" data-label=\"Java\"><div class=\"ghd-codetab-fallback-label\" role=\"heading\" aria-level=\"3\">Java</div>\n\n```java\nimport com.github.copilot.CopilotClient;\nimport com.github.copilot.rpc.*;\n\nvar client = new CopilotClient(new CopilotClientOptions()\n    .setUseLoggedInUser(false)  // Only use explicit tokens\n);\nclient.start().get();\n```\n\n</div>\n\n<div class=\"ghd-codetab\" data-lang=\"python\" data-label=\"Python\"><div class=\"ghd-codetab-fallback-label\" role=\"heading\" aria-level=\"3\">Python</div>\n\n```python\nclient = CopilotClient({\n    \"use_logged_in_user\": False,  # Only use explicit tokens\n})\n```\n\n</div>\n\n<div class=\"ghd-codetab\" data-lang=\"rust\" data-label=\"Rust\"><div class=\"ghd-codetab-fallback-label\" role=\"heading\" aria-level=\"3\">Rust</div>\n\n```rust\nuse github_copilot_sdk::{Client, ClientOptions};\n\nlet client = Client::start(\n    ClientOptions::default().with_use_logged_in_user(false),\n).await?;\n```\n\n</div>\n\n<div class=\"ghd-codetab\" data-lang=\"typescript\" data-label=\"TypeScript\"><div class=\"ghd-codetab-fallback-label\" role=\"heading\" aria-level=\"3\">TypeScript</div>\n\n```typescript\nconst client = new CopilotClient({\n    useLoggedInUser: false,  // Only use explicit tokens\n});\n```\n\n</div>\n\n</div>\n\n## 后续步骤\n\n* [BYOK （自带密钥）](/zh/copilot/how-tos/copilot-sdk/auth/byok) - 了解如何使用自己的 API 密钥\n* [构建你的第一个由 Copilot 提供支持的应用](/zh/copilot/how-tos/copilot-sdk/getting-started) - 生成第一个Copilot驱动的应用\n* [将 MCP 服务器与 GitHub Copilot SDK 配合使用](/zh/copilot/how-tos/copilot-sdk/features/mcp) - 连接到外部工具"}