Agentic workflows no longer need a personal access token
Quick Answer
GitHub Agentic Workflows now utilize the built-in GITHUB_TOKEN, removing the need for personal access tokens (PATs) and enhancing security.
Quick Take
GitHub Agentic Workflows now utilize the built-in GITHUB_TOKEN, removing the need for personal access tokens (PATs) and enhancing security. This change allows organizations to directly bill AI credits consumed by workflows, streamlining cost management without user-level inference budgets. Users must enable specific Copilot policies and ensure they are on the latest Agentic Workflows CLI version.
Key Points
- No need for personal access tokens (PATs) in GitHub Agentic Workflows.
- AI credits consumed are billed directly to the organization.
- Enable 'Allow use of Copilot CLI billed to the organization' policy for this feature.
- User-level inference budgets do not apply when billing to the organization.
- Cost management tools help monitor and cap token usage.
📖 Reader Mode
~2 min readYou can now use GitHub Agentic Workflows with GitHub Actions’s built-in GITHUB_TOKEN.
This means that you no longer need to create and store a personal access token (PAT), eliminating the operational and security risks of managing long-lived PATs for automations at scale.
When you use the Actions token in an agentic workflow running in an organization-owned repository, AI credits consumed by your agentic workflow are billed directly to the organization.
Configuring organization billing for Copilot CLI in GitHub Agentic Workflows
In order to use this feature, you must enable the “Allow use of Copilot CLI billed to the organization” Copilot policy. This is enabled by default if you have the existing “Copilot CLI” policy enabled.
Once enabled, you can configure agentic workflows to bill directly to the organization by adding copilot-requests: write to the permissions section in the frontmatter of your agentic workflow markdown file, then compiling and pushing your updated lockfile.
Note: You must be on the latest version of the Agentic Workflows CLI. Use
$ gh extension upgrade awto upgrade.
Controlling cost while billing to your organization
User-level inference budgets are not considered when billing directly to the organization, because the cost is not attributed to a user. There are multiple ways to manage spend when using this billing method:
- Configure cost centers for the relevant organizations. Cost centers allow cost attribution to groups of organizations, and budgets can be applied to cost centers.
- Use the cost management tools in GitHub Agentic Workflows to monitor, manage, and cap token usage per agentic workflow run.
To learn more, see the GitHub Agentic Workflows documentation about authentication.
This feature is available for all Copilot plans: Copilot Free, Copilot Pro, Copilot Pro+, Copilot Business, and Copilot Enterprise.
— Originally published at github.blog
Want this in your inbox every morning?
Daily brief at your local 8am — bilingual EN/中文, free.
More from GitHub Copilot Changelog
See more →Copilot usage metrics now include more of your active users
GitHub Copilot now enhances usage metrics by incorporating server-side telemetry, revealing previously unreported active users. This update increases daily active user counts and improves report consistency, addressing gaps caused by client-side telemetry failures.
