GitHub has introduced server-to-server authentication for the Copilot SDK. A GitHub App installed in an organization can request short-lived installation tokens and send Copilot requests that are attributed and billed to that organization. This matters for unattended systems: a service no longer has to pretend to be a continuously logged-in human developer.
The organization owner controls app permissions, model policy, budgets and revocation. GitHub documents a Copilot Requests organization permission and says installation tokens expire after an hour, so renewal is still a required operational component. This is a preview, not a blanket promise that every account can enable it.
For your consulting business, the pattern is interesting for client-owned agents or repeatable integration jobs. Start with a sandbox organization and a harmless read-only task, compare pricing against a direct OpenAI API integration, and test revocation and token rotation before any production use.
Check whether a test GitHub organization can enable the preview; do not move an existing personal-token workflow without a billing and rotation test.