[DOCS]: What OAuth scope is required for gh copilot?

Describe the need

➜  ~ gh copilot suggest "Receive webhooks locally"     

✗ Error: No valid OAuth token detected

I use a local GITHUB_TOKEN environment variable instead of gh's own credential. What OAuth scope is necessary? Ideally I'd add that information to both the README and the error message

Version

gh --version
gh version 2.38.0 (2023-11-01)
https://github.com/cli/cli/releases/tag/v2.38.0

I installed the extension just now

Relevant terminal output

➜  ~ gh extension install github/gh-copilot --force
✓ Installed extension github/gh-copilot
➜  ~ gh copilot suggest "Receive webhooks locally"     

✗ Error: No valid OAuth token detected

To get started with GitHub Copilot in the CLI, please run: gh auth login --web -h github.com to authenticate via web browser.

➜  ~ gh auth login --web -h github.com
The value of the GITHUB_TOKEN environment variable is being used for authentication.
To have GitHub CLI store credentials instead, first clear the value from the environment.
➜  ~ gh --version
gh version 2.38.0 (2023-11-01)
https://github.com/cli/cli/releases/tag/v2.38.0

@gr2m

Thanks for creating our first issue, @gr2m! 🎉

➜  ~ gh auth login --web -h github.com
The value of the GITHUB_TOKEN environment variable is being used for authentication.
To have GitHub CLI store credentials instead, first clear the value from the environment.

Since you're overriding the GITHUB_TOKEN, could you confirm that is a OAuth token (gho_...) or try clearing the environment variable out?

GitHub Copilot in the CLI currently works with OAuth tokens, but we have plans to support PATs in the near term. For now, using a PAT will trigger this error message.

Lastly, there is no new scope for OAuth tokens to work with GitHub Copilot or atleast with GitHub Copilot in the CLI.

Thanks for creating our first issue, @gr2m! 🎉

🫡

Since you're overriding the GITHUB_TOKEN, could you confirm that is a OAuth token (gho_...) or try clearing the environment variable out?

I think it's a classic personal access token ghp_..., which is an OAuth token under the hood right?

curl -H"Authorization: token $GITHUB_TOKEN" https://api.github.com/user -I
HTTP/2 200 
# ...
x-oauth-scopes: notifications, project, repo, workflow, write:org

I think it's a classic personal access token ghp_..., which is an OAuth token under the hood right?

😬 so we might need to improve the messaging here because you need to authenticate via the OAuth app in the web browser, not using a PAT. 🤔

$ gh auth login
? What account do you want to log into? GitHub.com
? What is your preferred protocol for Git operations? HTTPS
? How would you like to authenticate GitHub CLI? Login with a web browser

! First copy your one-time code: X#X#-X#X#
Press Enter to open github.com in your browser...

Getting this error when trying to use copilot cli in a codespace. The GITHUB_TOKEN is already set so I have to remove it to perform the login again and then it works.

@user ➜ /workspaces/project (main) $ ?? this is a test

✗ Error: No valid OAuth token detected

To get started with GitHub Copilot in the CLI, please run: gh auth login --web -h github.com to authenticate via web browser.

@user ➜ /workspaces/project(main) $ gh auth login --web -h github.com
The value of the GITHUB_TOKEN environment variable is being used for authentication.
To have GitHub CLI store credentials instead, first clear the value from the environment.

@gabynevada

Getting this error when trying to use copilot cli in a codespace. The GITHUB_TOKEN is already set so I have to remove it to perform the login again and then it works.

@user ➜ /workspaces/project (main) $ ?? this is a test

✗ Error: No valid OAuth token detected

To get started with GitHub Copilot in the CLI, please run: gh auth login --web -h github.com to authenticate via web browser.

@user ➜ /workspaces/project(main) $ gh auth login --web -h github.com
The value of the GITHUB_TOKEN environment variable is being used for authentication.
To have GitHub CLI store credentials instead, first clear the value from the environment.

Thank you for adding to this issue, @gabynevada! This is absolutely a limitation with the current way GitHub Codespaces provides an automatic token when a codespace is created.

As mentioned in "Troubleshooting authentication to a repository", this token is not a standard personal access token (PAT) or a token from authenticating GitHub or OAuth app but a user-to-server token (ghu_...).

Internally, discussions on how to extend Copilot integration support to PATs has been under discussion. I will make sure to bring up this aspect of leveraging with Codespaces ❤

Is there any way currently to obtain a valid OAuth token without opening a web browser? In a headless environment this is quite cumbersome.

Also interested..

Is there any way currently to obtain a valid OAuth token without opening a web browser? In a headless environment this is quite cumbersome.

Yes, kind of, using the device flow:
https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps#device-flow

I think it's off topic for this question though, best to ask in https://github.com/orgs/community/discussions/categories/api-and-webhooks, feel free to ping me in there

I use 1Password to store my PAT, which has its own plugin for gh.

Just wanted to throw out another use case where OAuth is cumbersome

@andyfeller

Hello @andyfeller

My specific question is not about the CLI but it seems very related to the topic and I'm hoping you can assist.

You wrote:

Lastly, there is no new scope for OAuth tokens to work with GitHub Copilot or atleast with GitHub Copilot in the CLI.

Question

Does this mean that the copilot access does not go through any scope?
That it is instead the approval for a specific client_id of the oAuth app which provides the authorization for copilot?

Is there a way to get a custom oAuth app to be able to approve github copilot in the device flow?

https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps#device-flow
It seems to have been done for the github copilot Plugin for JetBrains products.

@bd82

Is there a way to get a custom oAuth app to be able to approve github copilot in the device flow?

@bd82 : No, not currently. 😞

I have hopes given work around improving rate limit handling with the GitHub Copilot platform that this might change in the future. For now, GitHub Copilot in the CLI is only accessible via the GitHub CLI OAuth app.

@andyfeller

Thanks for the information @andyfeller

@jtabox

Happy to contribute :)

Thanks for taking the time to soundboard suggestions, @jtabox! 🙇 I think suggestions 1 + 3 make the most sense for GitHub Copilot in the CLI being a separate extension from the core GitHub CLI.

I'm going to follow up internally to cue this up as it requires changes to GitHub Docs as well as this repository. 👍

Happy to contribute :)

Thanks for taking the time to soundboard suggestions, @jtabox! 🙇 I think suggestions 1 + 3 make the most sense for GitHub Copilot in the CLI being a separate extension from the core GitHub CLI.
I'm going to follow up internally to cue this up as it requires changes to GitHub Docs as well as this repository. 👍

Sadly, these are changes on internal repos, but I appreciate your support 🙇

Happy to contribute :)

Thanks for taking the time to soundboard suggestions, @jtabox! 🙇 I think suggestions 1 + 3 make the most sense for GitHub Copilot in the CLI being a separate extension from the core GitHub CLI.
I'm going to follow up internally to cue this up as it requires changes to GitHub Docs as well as this repository. 👍

Sadly, these are changes on internal repos, but I appreciate your support 🙇

Yepp, I was a bit unclear in my reply I think. With "contribution" I meant my previous comment itself, with the suggestions. So "Happy to contribute" meant "Happy to have helped", not "I can open a PR with my suggestions if you'd like." 😄 But anyway, won't spam this thread any further 😄 For now I've switched to OAuth for gh and Copilot works fine, hopefully at some point it becomes available with GITHUB_TOKEN too.

@jtabox

it becomes available with GITHUB_TOKEN too.

@jtabox : Just to be clear, are you saying

GITHUB_TOKEN environment variable doesn't work if you provide it with your GitHub CLI OAuth token at all
neither classic or fine-grain PATs are supported

I think you're saying the latter as below demonstrates that GITHUB_TOKEN environment variable should work if it is set to your GitHub CLI OAuth app token:

$ GITHUB_TOKEN=$(gh auth token --hostname github.com) gh copilot explain 'echo "hello world"' 

Welcome to GitHub Copilot in the CLI!
version 1.0.5 (2024-09-12)

I'm powered by AI, so surprises and mistakes are possible. Make sure to verify any generated code or suggestions, and share feedback so that we can learn and improve. For more information, see https://gh.io/gh-copilot-transparency

Explanation:                                                                                                                                                                                                                                                                                              
                                                                                                                                                                                                                                                                                                          
  • echo is used to print text to the terminal.                                                                                                                                                                                                                                                           
    • "hello world" is the text that will be printed.                                                                                                                                                                                                                                                     
                                                                                                                                                                                                                                                                                                          ```

I'm not sure I understood your question correctly, so my reply might be completely irrelevant, in which case I apologize 😅

My GITHUB_TOKEN variable in Windows contains indeed a classic PAT (I think it's the same situation as many people in this thread, incl. the initial post). I've been using it in various programs that want my GitHub account's "API key".

When I first installed gh, seeing that the instructions mention that gh will use GITHUB_TOKEN if available for authentication, I just kept using the existing GITHUB_TOKEN, which indeed worked fine.

C:\gh auth status

github.com
  ✓ Logged in to github.com account jtabox (GITHUB_TOKEN)
  - Token: ghp_************************************

But then when I tried to run Copilot I'd get an error.

C:\gh copilot explain "format C:"

✗ Error: No valid GitHub CLI OAuth token detected
To get started with GitHub Copilot in the CLI, please run: gh auth login --web -h github.com to authenticate via web browser.

I ran the suggested gh auth login --web ... command and the authentication process succeeded (though not sure how it would go if only the terminal was available). But going back to the command prompt and trying to run Copilot still gave the exact same error as above and suggested the same command, which is a loop I tried 2-3 times before I started suspecting it wouldn't work.

There wasn't any information anywhere that as long as I have a PAT as the GITHUB_TOKEN's value (which had worked fine for gh so far), Copilot won't run, and that I needed to change authentication method altogether and either replace the value of GITHUB_TOKEN with an OAuth token, or completely remove it as environment variable.

If I understood correctly, what you're suggesting is the first alternative? I.e. to swap to OAuth and then change GITHUB_TOKEN's value from a ghp_... token to an OAuth gho_... token every time I want to run Copilot? Since it can't be a permanent change, otherwise other programs that use it won't work. It's a solution, at least for Linux systems, since Windows will require a mini script for setting the variable before each run.

@jtabox

Thanks for clarifying, @jtabox! 👍 For clarity, I'm definitely not suggesting that people managing OAuth tokens in the environment variables; simply that it isn't a problem with environment variables as a mechanism but the nature of the token.

Good news: with the repository readme updated and GitHub Docs change being processed, I feel this issue can long be closed.

@andyfeller

@andyfeller - I'm unclear on the solution. I too need the GITHUB_TOKEN present in the environment to access Github repository packages via npm/yarn.

So, I did the following:

unset GITHUB_TOKEN
gh auth login --web -h github.com
gh auth status                                                                                                                                                                                                                                                                                           ✘ 2 
github.com
  ✓ Logged in to github.com account rosskevin (keyring)
  - Active account: true
  - Git operations protocol: https
  - Token: gho_************************************
  - Token scopes: 'gist', 'read:org', 'repo', 'workflow'

but when opening a new terminal, back to the same error:

✗ Error: No valid GitHub CLI OAuth token detected

So I need to unset GITHUB_TOKEN for every new terminal where I want to use authenticated gh? Or is there a better solution?

Maybe this needs to be new issue, but gh copilot really should support auth via PAT.

Maybe this needs to be new issue, but gh copilot really should support auth via PAT.

Yes, a separate issue for that would be ideal.

That said, please trust when I say it's a topic I've been raising internally since initial extension development. There are some broader Copilot ecosystem architecture discussions involved.

@andyfeller

I've been trying to figure out how to use GH CLI and Copilot extension with PAT. Eventually I stumbled up this issue and the #98 which seems to be «a separate issue for that would be ideal».
@andyfeller Is that issue something you mean or there's a need to create something separate (in this case please briefly outline what info should be put on it)? Thanks.

@yermulnik

@yermulnik : created #116 to follow up on this 👍

@andyfeller

@andyfeller Appreciate it 👍🏻

@andyfeller - I'm unclear on the solution. I too need the GITHUB_TOKEN present in the environment to access Github repository packages via npm/yarn.

So, I did the following:

unset GITHUB_TOKEN
gh auth login --web -h github.com
gh auth status ✘ 2
github.com
✓ Logged in to github.com account rosskevin (keyring)

Active account: true

Git operations protocol: https

Token: gho_************************************

Token scopes: 'gist', 'read:org', 'repo', 'workflow'
but when opening a new terminal, back to the same error:
✗ Error: No valid GitHub CLI OAuth token detected
So I need to unset GITHUB_TOKEN for every new terminal where I want to use authenticated gh? Or is there a better solution?

What I did to solve my problema was:

unset GITHUB_TOKEN
authenticated with 'gh auth login --web -h github.com'
got the token with 'gh auth token -h githbu.com' (the token will start with "gho_")
set the GH_TOKEN with this value. (I did put this in my startup script - .zshrc/.bashrc and $PROFILE for PowerShell)
GH_TOKEN has precedence over GITHUB_TOKEN, so both can be set and the gh cli will use the GH_TOKEN.

Now I can use the cli and keep my GITHUB_TOKEN for use in other scenarios.

What I did to solve my problema was:

unset GITHUB_TOKEN

authenticated with 'gh auth login --web -h github.com'

got the token with 'gh auth token -h githbu.com' (the token will start with "gho_")

set the GH_TOKEN with this value. (I did put this in my startup script - .zshrc/.bashrc and $PROFILE for PowerShell)

GH_TOKEN has precedence over GITHUB_TOKEN, so both can be set and the gh cli will use the GH_TOKEN.

Now I can use the cli and keep my GITHUB_TOKEN for use in other scenarios.

This solution with GH_TOKEN must be something new, because it hasn't been mentioned previously. And it's indeed a great solution, thanks for the tip. Used it just now in my Windows machine and it worked fine, so now there's no need to unset GITHUB_TOKEN whenever I need to run copilot any more.

Navigation Menu

Repository navigation

[DOCS]: What OAuth scope is required for `gh copilot`? #1

Describe the need

Version

Relevant terminal output

Question

8 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[DOCS]: What OAuth scope is required for gh copilot? #1

Description

Describe the need

Version

Relevant terminal output

Activity

andyfeller commented on Nov 8, 2023

gr2m commented on Nov 8, 2023

andyfeller commented on Nov 8, 2023

gabynevada commented on Dec 14, 2023

andyfeller commented on Dec 15, 2023

thethomasboyer commented on Dec 21, 2023

pentago commented on Dec 23, 2023

gr2m commented on Jan 9, 2024

LukeHendrick commented on Feb 13, 2024

bd82 commented on Feb 25, 2024

Question

andyfeller commented on Feb 26, 2024

bd82 commented on Mar 3, 2024

8 remaining items

jtabox commented on Nov 7, 2024

andyfeller commented on Nov 8, 2024

jtabox commented on Nov 8, 2024

andyfeller commented on Nov 15, 2024

jtabox commented on Nov 15, 2024

andyfeller commented on Nov 18, 2024

rosskevin commented on Dec 20, 2024

diminutivesloop commented on Dec 23, 2024

andyfeller commented on Jan 6, 2025

yermulnik commented on Jan 7, 2025

andyfeller commented on Jan 7, 2025

yermulnik commented on Jan 7, 2025

jmarcon commented on May 7, 2025

jtabox commented on May 7, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[DOCS]: What OAuth scope is required for `gh copilot`? #1