Support for ephemeral tokens in Model providers · Issue #4848 · github/app · GitHub
Skip to content

Support for ephemeral tokens in Model providers #4848

Open

Description

@kuisathaverat

Support for ephemeral tokens in Model providers
We added recently the Google compatible OpenAI API to our model providers in GitHub App, our company have policies to restrict the TTL of the API keys so we have to rotate them often. The only way I found to rotate the API key in the model provider is using the UI. Investigating a lible I found the configuration in the SQLite DB and I can update it using a script, but it is a workaround, could be nice to have a way to inject those API keys from the environment or a way to refresh tem every certain time, or force the process to get the API key from a credentials helper like git.
Also, Beared token authentication is not supported you have to use the custom headers and pass the Authorization: Beared <TOKEN> header.


Field Value
App version 1.1.29
OS macOS 26.7.1
Theme GitHub
Path /workflows
Tenure Week 22

Activity

  1. kuisathaverat commented on Oct 19, 2026

    @kuisathaverat
    Author

    This is the workaround I am using for now.

    github-app-token-update(){
      ADC_FILE="${CLOUDSDK_CONFIG:-$HOME/.config/gcloud}/application_default_credentials.json"
      TOKEN="$(curl -s -X POST https://oauth2.googleapis.com/token \
        -d "client_id=$(jq -r .client_id "$ADC_FILE")" \
        -d "client_secret=$(jq -r .client_secret "$ADC_FILE")" \
        -d "refresh_token=$(jq -r .refresh_token "$ADC_FILE")" \
        -d "grant_type=refresh_token" | jq -r .access_token)" && \
        sqlite3 ~/.copilot/data.db   "UPDATE model_providers
          SET settings_json = json_set(settings_json, '$.headersJson', '{\"Authorization\":\"Bearer $TOKEN\"}'),
          updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
          WHERE name = 'Google';"
    }
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions