Side Quest: Method 2

Optional: use this method for personal billing, or when the organization that owns the repository does not have centralized Copilot billing enabled.

This method stores a Personal Access Token (PAT) as a repository secret named COPILOT_GITHUB_TOKEN. The agentic workflow engine picks it up automatically. For background on PAT types and when to use each, see the auth overview.

If you want an all-UI path with no terminal commands, use Method 2 (UI-only).

:clipboard: Before You Start

• You have a GitHub account with an active Copilot subscription.
• You have read Side Quest: Configure GitHub Copilot Authentication and chosen Method 2.

Shortest terminal path

If your workflow currently includes copilot-requests: write, remove that line first. When it is present, the workflow ignores COPILOT_GITHUB_TOKEN for inference.

Then run:

gh aw secrets bootstrap --engine copilot

This guided flow checks whether the secret is missing, walks you through creating or pasting a valid fine-grained PAT, and stores it as COPILOT_GITHUB_TOKEN.

If you prefer to create and store the PAT manually, follow the full procedure below.

:pencil2: Sub-exercise A: Generate the token manually

1. Go to github.com/settings/tokens and click Generate new token (fine-grained).
2. Name the token (for example, gh-aw-copilot) and set an expiry (90 days is a common default).
3. For a public workshop repository, choose Public repositories. For a private workshop repository, choose Only select repositories and select it.
4. Under Permissions → Account permissions, set Copilot requests to Read-only.
5. Click Generate token and copy the value immediately — GitHub shows it only once.

Add a rotation reminder so you remember to renew the token before it expires:

printf 'Rotate COPILOT_GITHUB_TOKEN by YYYY-MM-DD\n' >> ~/copilot-token-rotation.txt

Replace YYYY-MM-DD with your token expiry date.

• I copied the token value before leaving the page
• I noted the token rotation date

:pencil2: Sub-exercise B: Store the secret manually

Store the token as a repository secret:

gh secret set COPILOT_GITHUB_TOKEN

This prompts for the token value interactively. Alternatively, follow the complete UI steps in Method 2 (UI-only).

Try it — verify the secret was saved:

gh secret list | grep COPILOT_GITHUB_TOKEN

You should see COPILOT_GITHUB_TOKEN in the output. Once confirmed, you can safely close the token tab.

• COPILOT_GITHUB_TOKEN appears in the repository secrets list
• I closed the token tab only after confirming the secret was saved

Select the token in your workflow

If you have not already done so, remove copilot-requests: write from the source workflow. When that permission is present, the workflow ignores COPILOT_GITHUB_TOKEN for inference.

gh aw compile
git add .
git commit -m "Use personal Copilot billing"
git push

The compile updates the lock file so it uses the token-based method.

✅ Checkpoint

• You generated a fine-grained PAT with Copilot requests: Read-only under Account permissions
• COPILOT_GITHUB_TOKEN exists in your repository's Actions secrets
• gh secret list confirms the secret is present
• copilot-requests: write is not present in the source workflow
• The recompiled source and lock files are committed
• You noted the PAT expiry date and have a rotation reminder

Need a refresher on when to choose Method 2 or how this fits your auth setup? Go back to Side Quest: Configure GitHub Copilot Authentication.

Return to: Install the gh-aw CLI Extension | Write Your First Agentic Workflow