Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 23 additions & 23 deletions docs/auth/byok.md
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# BYOK (Bring Your Own Key)
# BYOK (bring your own key)

BYOK allows you to use the Copilot SDK with your own API keys from model providers, bypassing GitHub Copilot authentication. This is useful for enterprise deployments, custom model hosting, or when you want direct billing with your model provider.

## Supported Providers
## Supported providers

| Provider | Type Value | Notes |
|----------|------------|-------|
Expand All @@ -13,7 +13,7 @@ BYOK allows you to use the Copilot SDK with your own API keys from model provide
| Microsoft Foundry Local | `"openai"` | Run AI models locally on your device via OpenAI-compatible API |
| Other OpenAI-compatible | `"openai"` | vLLM, LiteLLM, etc. |

## Quick Start: Azure AI Foundry
## Quick start: Azure AI Foundry

Azure AI Foundry (formerly Azure OpenAI) is a common BYOK deployment target for enterprises. Here's a complete example:

Expand Down Expand Up @@ -196,9 +196,9 @@ client.stop().get();

</details>

## Provider Configuration Reference
## Provider configuration reference

### ProviderConfig Fields
### ProviderConfig fields

| Field | Type | Description |
|-------|------|-------------|
Expand All @@ -209,14 +209,14 @@ client.stop().get();
| `wireApi` / `wire_api` | `"completions"` \| `"responses"` | API format (default: `"completions"`) |
| `azure.apiVersion` / `azure.api_version` | string | Azure API version (default: `"2024-10-21"`) |

### Wire API Format
### Wire API format

The `wireApi` setting determines which OpenAI API format to use:

- **`"completions"`** (default) - Chat Completions API (`/chat/completions`). Use for most models.
- **`"responses"`** - Responses API. Use for GPT-5 series models that support the newer responses format.

### Type-Specific Notes
### Type-specific notes

**OpenAI (`type: "openai"`)**
- Works with OpenAI API and any OpenAI-compatible endpoint
Expand All @@ -231,9 +231,9 @@ The `wireApi` setting determines which OpenAI API format to use:
- For direct Anthropic API access
- Uses Claude-specific API format

## Example Configurations
## Example configurations

### OpenAI Direct
### OpenAI direct

```typescript
provider: {
Expand All @@ -243,7 +243,7 @@ provider: {
}
```

### Azure OpenAI (Native Azure Endpoint)
### Azure OpenAI (native Azure endpoint)

Use `type: "azure"` for endpoints at `*.openai.azure.com`:

Expand All @@ -258,7 +258,7 @@ provider: {
}
```

### Azure AI Foundry (OpenAI-Compatible Endpoint)
### Azure AI Foundry (OpenAI-compatible endpoint)

For Azure AI Foundry deployments with `/openai/v1/` endpoints, use `type: "openai"`:

Expand All @@ -271,7 +271,7 @@ provider: {
}
```

### Ollama (Local)
### Ollama (local)

```typescript
provider: {
Expand Down Expand Up @@ -322,7 +322,7 @@ provider: {
}
```

### Bearer Token Authentication
### Bearer token authentication

Some providers require bearer token authentication instead of API keys:

Expand All @@ -336,7 +336,7 @@ provider: {

> **Note:** The `bearerToken` option accepts a **static token string** only. The SDK does not refresh this token automatically. If your token expires, requests will fail and you'll need to create a new session with a fresh token.

## Custom Model Listing
## Custom model listing

When using BYOK, the CLI server may not know which models your provider supports. You can supply a custom `onListModels` handler at the client level so that `client.listModels()` returns your provider's models in the standard `ModelInfo` format. This lets downstream consumers discover available models without querying the CLI.

Expand Down Expand Up @@ -473,13 +473,13 @@ Results are cached after the first call, just like the default behavior. The han

When using BYOK, be aware of these limitations:

### Identity Limitations
### Identity limitations

BYOK authentication uses **static credentials only**.

You must use an API key or static bearer token that you manage yourself.

### Feature Limitations
### Feature limitations

Some Copilot features may behave differently with BYOK:

Expand All @@ -488,7 +488,7 @@ Some Copilot features may behave differently with BYOK:
- **Usage tracking** - Usage is tracked by your provider, not GitHub Copilot
- **Premium requests** - Do not count against Copilot premium request quotas

### Provider-Specific Limitations
### Provider-specific limitations

| Provider | Limitations |
|----------|-------------|
Expand All @@ -499,7 +499,7 @@ Some Copilot features may behave differently with BYOK:

## Troubleshooting

### "Model not specified" Error
### "Model not specified" error

When using BYOK, the `model` parameter is **required**:

Expand All @@ -516,7 +516,7 @@ const session = await client.createSession({
});
```

### Azure Endpoint Type Confusion
### Azure endpoint type confusion

For Azure OpenAI endpoints (`*.openai.azure.com`), use the correct type:

Expand Down Expand Up @@ -574,7 +574,7 @@ provider: {
}
```

### Connection Refused (Ollama)
### Connection refused (Ollama)

Ensure Ollama is running and accessible:

Expand All @@ -586,7 +586,7 @@ curl http://localhost:11434/v1/models
ollama serve
```

### Connection Refused (Foundry Local)
### Connection refused (Foundry Local)

Foundry Local uses a dynamic port that may change between restarts. Confirm the active port:

Expand All @@ -601,13 +601,13 @@ Update your `baseUrl` to match the port shown in the output. If the service is n
foundry model run phi-4-mini
```

### Authentication Failed
### Authentication failed

1. Verify your API key is correct and not expired
2. Check the `baseUrl` matches your provider's expected format
3. For bearer tokens, ensure the full token is provided (not just a prefix)

## Next Steps
## Next steps

- [Authentication Overview](./index.md) - Learn about all authentication methods
- [Getting Started Guide](../getting-started.md) - Build your first Copilot-powered app
14 changes: 7 additions & 7 deletions docs/auth/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

The GitHub Copilot SDK supports multiple authentication methods to fit different use cases. Choose the method that best matches your deployment scenario.

## Authentication Methods
## Authentication methods

| Method | Use Case | Copilot Subscription Required |
|--------|----------|-------------------------------|
Expand All @@ -11,7 +11,7 @@ The GitHub Copilot SDK supports multiple authentication methods to fit different
| [Environment Variables](#environment-variables) | CI/CD, automation, server-to-server | Yes |
| [BYOK (Bring Your Own Key)](./byok.md) | Using your own API keys (Azure AI Foundry, OpenAI, etc.) | No |

## GitHub Signed-in User
## GitHub signed-in user

This is the default authentication method when running the Copilot CLI interactively. Users authenticate via GitHub OAuth device flow, and the SDK uses their stored credentials.

Expand Down Expand Up @@ -231,7 +231,7 @@ client.start().get();
- SaaS applications building on top of Copilot
- Any multi-user application where you need to make requests on behalf of different users

## Environment Variables
## Environment variables

For automation, CI/CD pipelines, and server-to-server scenarios, you can authenticate using environment variables.

Expand Down Expand Up @@ -279,7 +279,7 @@ await client.start()
- Server-side applications with service accounts
- Development when you don't want to use interactive login

## BYOK (Bring Your Own Key)
## BYOK (bring your own key)

BYOK allows you to use your own API keys from model providers like Azure AI Foundry, OpenAI, or Anthropic. This bypasses GitHub Copilot authentication entirely.

Expand All @@ -295,7 +295,7 @@ BYOK allows you to use your own API keys from model providers like Azure AI Foun
- Limitations and considerations
- Complete code examples

## Authentication Priority
## Authentication priority

When multiple authentication methods are available, the SDK uses them in this priority order:

Expand All @@ -306,7 +306,7 @@ When multiple authentication methods are available, the SDK uses them in this pr
5. **Stored OAuth credentials** - From previous `copilot` CLI login
6. **GitHub CLI** - `gh auth` credentials

## Disabling Auto-Login
## Disabling auto-login

To prevent the SDK from automatically using stored credentials or `gh` CLI auth, use the `useLoggedInUser: false` option:

Expand Down Expand Up @@ -395,7 +395,7 @@ client.start().get();

</details>

## Next Steps
## Next steps

- [BYOK Documentation](./byok.md) - Learn how to use your own API keys
- [Getting Started Guide](../getting-started.md) - Build your first Copilot-powered app
Expand Down
Loading