GitHub Agentic Workflows now use GITHUB_TOKEN, no PAT needed
GitHub Agentic Workflows have been updated to use GitHub Actions' built-in GITHUB_TOKEN, eliminating the need for personal access tokens (PATs). This change simplifies management, reduces security risks, and allows AI credit consumption to be billed directly to organizations. Configuration requires enabling a Copilot policy and updating workflow permissions, with cost management options available for organizations.
- →Use GITHUB_TOKEN for Agentic Workflows, removing PAT requirement
- →Enable organization billing for Agentic Workflows
- →Manage costs with organization billing for Agentic Workflows
- →Update Agentic Workflows CLI for new features
- →Feature available across all Copilot plans
Features (1) ›
- Use GITHUB_TOKEN for Agentic Workflows, removing PAT requirement
Agentic workflows can now leverage GitHub Actions' GITHUB_TOKEN, eliminating the operational and security overhead of managing personal access tokens (PATs).
Enhancements (2) ›
- Enable organization billing for Agentic Workflows
AI credit consumption by agentic workflows in organization-owned repositories is now billed directly to the organization. This requires enabling a specific Copilot policy and updating workflow frontmatter to include `copilot-requests: write`.
- Manage costs with organization billing for Agentic Workflows
Organizations can manage spend by configuring cost centers and applying budgets, or by using the cost management tools within GitHub Agentic Workflows to monitor and cap token usage.
Notes (2) ›
- Update Agentic Workflows CLI for new features
Users must be on the latest version of the Agentic Workflows CLI to utilize these new features. Upgrade using the command `$ gh extension upgrade awto`.
- Feature available across all Copilot plans
This update for GitHub Agentic Workflows is accessible to users on all Copilot plans, including Copilot Free, Copilot Pro, Copilot Pro+, Copilot Business, and Copilot Enterprise.
https://github.blog/changelog/2026-06-11-agentic-workflows-no-longer-need-a-personal-access-token