GitHub Copilot CLI needs an active Copilot subscription and a GitHub identity. Interactive
sessions sign in with /login; CI reads a token from an environment variable.
1. Start the CLI and log in
copilot
Launching opens a session, and if you are not signed in it prompts you to authenticate.
/login
Run that slash command, follow the browser prompt, and the CLI stores the credential for next time.
2. Confirm your Copilot access
You need an active GitHub Copilot plan on your account; without one, login can succeed but every request is refused. In an organization or enterprise, an owner must also leave Copilot CLI enabled in policy. New to the tool? See GitHub Copilot CLI first steps for install and first prompts — it is an agent, not autocomplete.
3. Create a token for non-interactive use
For CI or scripts, make a fine-grained personal access token instead of logging in.
Settings → Developer settings → Fine-grained tokens → Account permissions → Copilot Requests
Set the resource owner to your personal account — the Copilot Requests permission exists only on user-owned tokens — then generate and copy it.
4. Export the token
export GITHUB_TOKEN=github_pat_xxxxxxxx
The CLI checks COPILOT_GITHUB_TOKEN, then GH_TOKEN, then GITHUB_TOKEN, and uses the first one
set.
$env:GITHUB_TOKEN = "github_pat_xxxxxxxx"
Set the same variable in PowerShell for a Windows runner or shell.
Verify it worked
copilot
Start a fresh session and send any request; a normal reply instead of a login prompt confirms the credential is live. If it fails:
- A login prompt in CI — no token was found; export
GITHUB_TOKENin the job environment, not in a later step. - 403 or “no Copilot access” — the subscription is inactive or an admin disabled Copilot CLI; check your plan and org policy.
- Token rejected — recreate it with the Copilot Requests account permission; classic OAuth scopes do not grant it.
Next: Codex CLI first steps or connect Claude Code to GitHub. Full flow: GitHub’s install guide.