docs: tighten server-to-server auth guidance - #2125
Merged
SteveSandersonMS merged 4 commits intoJul 29, 2026
Merged
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
SteveSandersonMS
marked this pull request as ready for review
July 29, 2026 14:35
Contributor
There was a problem hiding this comment.
Pull request overview
Tightens server-to-server authentication guidance across all SDKs and runtime modes.
Changes:
- Recommends built-in
GITHUB_TOKENfor GitHub Actions. - Adds concise setup examples for all six SDKs.
- Clarifies token routing, refresh, and billing behavior.
Show a summary per file
| File | Description |
|---|---|
docs/README.md |
Updates authentication navigation. |
docs/auth/README.md |
Renames and expands the guide entry. |
docs/auth/authenticate.md |
Clarifies server authentication requirements. |
docs/auth/server-to-server-tokens.md |
Reworks the full server authentication guide. |
Review details
- Files reviewed: 4/4 changed files
- Comments generated: 1
- Review effort level: Medium
| When you refresh the token, start a new Copilot SDK client with an updated `COPILOT_GITHUB_TOKEN` value. The Copilot CLI subprocess reads its environment when it starts and does not re-read the token during an existing session. | ||
|
|
||
| Rotate the GitHub App private key according to your organization's security policy. If a token is exposed, revoke the installation token and rotate the app private key. | ||
| For in-process FFI, set `COPILOT_GITHUB_TOKEN` in the host environment before loading the runtime; per-client environment options are not supported. For an existing runtime URI, set it on that runtime process. |
pull Bot
pushed a commit
to eoinmcgee1993/copilot-sdk
that referenced
this pull request
Jul 29, 2026
* docs: add server-to-server token guide Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2a84bd21-23e5-4358-96f1-f343030bb869 * docs: tighten server-to-server auth guidance (github#2125) * docs: tighten server-to-server auth guidance Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: add per-language server auth examples Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: clarify installation billing attribution Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: restore server auth troubleshooting cases Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Steve Sanderson <SteveSandersonMS@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2a84bd21-23e5-4358-96f1-f343030bb869
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GITHUB_TOKENfor GitHub ActionsValidation