# Authenticate GitHub Copilot CLI (login and GITHUB_TOKEN)

> Log in to GitHub Copilot CLI with /login, check your Copilot subscription, and set GITHUB_TOKEN for CI with the Copilot Requests permission.

- Canonical: https://guides-ai.com/guides/github-copilot-cli-authentication/
- Plate 14.11 · Topic: Other coding agents (https://guides-ai.com/topics/agents/)
- Published: 21 Oct 2026 · 3 min read
- Source site: guides-ai — https://guides-ai.com/

GitHub Copilot CLI needs an active Copilot subscription and a GitHub identity. Interactive
sessions sign in with `/login`; CI reads a token from an environment variable.

## 1. Start the CLI and log in

```bash
copilot
```

Launching opens a session, and if you are not signed in it prompts you to authenticate.

```text
/login
```

Run that slash command, follow the browser prompt, and the CLI stores the credential for next
time.

## 2. Confirm your Copilot access

You need an active GitHub Copilot plan on your account; without one, login can succeed but every
request is refused. In an organization or enterprise, an owner must also leave Copilot CLI enabled
in policy. New to the tool? See [GitHub Copilot CLI first steps](/guides/github-copilot-cli-first-steps/)
for install and first prompts — it is an [agent](/glossary/#agent), not autocomplete.

## 3. Create a token for non-interactive use

For CI or scripts, make a fine-grained personal access token instead of logging in.

```text
Settings → Developer settings → Fine-grained tokens → Account permissions → Copilot Requests
```

Set the resource owner to your personal account — the Copilot Requests permission exists only on
user-owned tokens — then generate and copy it.

## 4. Export the token

```bash
export GITHUB_TOKEN=github_pat_xxxxxxxx
```

The CLI checks `COPILOT_GITHUB_TOKEN`, then `GH_TOKEN`, then `GITHUB_TOKEN`, and uses the first one
set.

```powershell
$env:GITHUB_TOKEN = "github_pat_xxxxxxxx"
```

Set the same variable in PowerShell for a Windows runner or shell.

## Verify it worked

```bash
copilot
```

Start a fresh session and send any request; a normal reply instead of a login prompt confirms the
credential is live. **If it fails:**

- **A login prompt in CI** — no token was found; export `GITHUB_TOKEN` in the job environment, not
  in a later step.
- **403 or "no Copilot access"** — the subscription is inactive or an admin disabled Copilot CLI;
  check your plan and org policy.
- **Token rejected** — recreate it with the Copilot Requests account permission; classic OAuth
  scopes do not grant it.

Next: [Codex CLI first steps](/guides/codex-cli-first-steps/) or
[connect Claude Code to GitHub](/guides/connect-claude-code-to-github/). Full flow:
[GitHub's install guide](https://docs.github.com/en/copilot/how-tos/set-up/install-copilot-cli).