Commit 81deeed

fpt: '*'

ghec: '*'

ghes: '>=3.22'

1. {% data reusables.copilot.copilot-cli.start-cli %}

{% ifversion ghes %}

{% data variables.copilot.copilot_cli_short %} can be configured to work with {% data variables.product.prodname_ghe_server %} for enterprises that operate in disconnected or air-gapped environments without connectivity to {% data variables.product.github %} Cloud. Your {% data variables.product.prodname_ghe_server %} administrator configures a model provider once, and users across the enterprise can use {% data variables.copilot.copilot_cli_short %} with their {% data variables.product.prodname_ghe_server %} credentials.

Setting up this feature involves two roles:

* **Administrator**: Configures the model provider on the {% data variables.product.prodname_ghe_server %} instance using `ghe-config`. This is a one-time setup that requires administrative SSH access.

* **End user**: Sets environment variables on their local machine to connect {% data variables.copilot.copilot_cli_short %} to the instance.

* Your {% data variables.product.prodname_ghe_server %} administrator has configured a model provider on the instance. See [Configuring your {% data variables.product.prodname_ghe_server %} instance](#configuring-your-github-enterprise-server-instance).

* {% data variables.copilot.copilot_cli_short %} is installed on client machines. See [AUTOTITLE](/copilot/how-tos/copilot-cli/set-up-copilot-cli/install-copilot-cli).

* {% data variables.product.company_short %} CLI (`gh`) is installed on client machines. See [Installing gh](https://cli.github.com/manual/installation).

The same [supported providers](#supported-providers) and [model requirements](#model-requirements) apply.

This step is for the operator or administrator of the {% data variables.product.prodname_ghe_server %} instance.

With administrative SSH access to the {% data variables.product.prodname_ghe_server %} instance, configure the model provider using the following `ghe-config` values. After configuring, run `ghe-config-apply` to apply the changes.

| Variable name | Required | Options | Description |

|---|---|---|---|

| `app.copilot-proxy.enabled` | Yes | `true`, `false` | Enables or disables the feature. |

| `app.copilot-proxy.endpoint-url` | Yes | URI | The full upstream base URL including any version prefix (for example, `https://api.openai.com/v1`). |

| `secrets.copilot-proxy.endpoint-key` | Yes | String | The API key for the upstream provider. |

| `app.copilot-proxy.provider-model-id` | Yes | String | The provider model ID that {% data variables.copilot.copilot_cli_short %} uses to look up the model internally. |

| `app.copilot-proxy.provider-type` | Yes | `openai`, `azure`, `anthropic` | The provider type. OpenAI includes OpenAI, Ollama, vLLM, Foundry Local, and any other OpenAI Chat Completions API-compatible endpoint. |

| `app.copilot-proxy.upstream-timeout` | No | Integer (seconds) | Read/send timeout in seconds for upstream requests. If not set, falls back to the default timeout. |

| `app.copilot-proxy.provider-wire-api` | No | `completions`, `responses` | The wire API format for the provider. |

| `app.copilot-proxy.provider-wire-model` | No | String | Overrides the model identifier sent to the upstream provider if it differs from the internal model ID. |

| `app.copilot-proxy.enable-upstream-probe` | No | `true`, `false` | Enables or disables the startup upstream probe. Defaults to enabled. When disabled, the startup probe is skipped. |

ghe-config app.copilot-proxy.enabled true

ghe-config app.copilot-proxy.endpoint-url 'https://api.openai.com/v1'

ghe-config secrets.copilot-proxy.endpoint-key 'YOUR-API-KEY'

ghe-config app.copilot-proxy.provider-model-id 'gpt-5.5'

ghe-config app.copilot-proxy.provider-wire-model 'gpt-5.5'

ghe-config app.copilot-proxy.provider-type openai

ghe-config app.copilot-proxy.upstream-timeout 300

ghe-config app.copilot-proxy.enable-upstream-probe false

ghe-config-apply

Replace `YOUR-API-KEY` with the real API key before applying.

Configure {% data variables.copilot.copilot_cli_short %} to connect to your {% data variables.product.prodname_ghe_server %} instance by setting the following environment variables before starting {% data variables.copilot.copilot_cli_short %}.

| Environment variable | Required | Description |

|---|---|---|

| `COPILOT_PROVIDER_GHES_HOST` | Yes | The hostname of your {% data variables.product.prodname_ghe_server %} instance. |

| `COPILOT_PROVIDER_GHES_TOKEN` | Yes | A {% data variables.product.pat_generic %} for the {% data variables.product.prodname_ghe_server %} instance. This token authenticates requests to the instance. |

| `COPILOT_OFFLINE=true` | Yes | Enables offline mode. The {% data variables.product.prodname_ghe_server %} provider is only active when offline mode is enabled. |

{% data variables.copilot.copilot_cli_short %} needs access to LLM inference, so `COPILOT_PROVIDER_GHES_TOKEN` is always required. You will also very likely want {% data variables.copilot.copilot_cli_short %} to perform {% data variables.product.github %} operations such as create issues, pull requests, and search repositories. Such operations can be done via the {% data variables.product.github %} CLI.

It is recommended and preferred that you run `gh auth login --hostname YOUR-GHES-HOSTNAME`. After it succeeds, next step is to set COPILOT_PROVIDER_GHES_TOKEN to the token generated in `gh auth login --hostname YOUR-GHES-HOSTNAME`. It is more secure to retrieve the token dynamically rather than copying it from `~/.config/gh/hosts.yml`. You can do so by using `COPILOT_PROVIDER_GHES_TOKEN="$(gh auth token --hostname YOUR-GHES-HOSTNAME)"`.

Alternatively, you can generate a {% data variables.product.pat_generic %} on your {% data variables.product.prodname_ghe_server %} instance, set that token as `COPILOT_PROVIDER_GHES_TOKEN`, and use the same token when running `gh auth login --hostname YOUR-GHES-HOSTNAME`.

The above approach works when you are using {% data variables.copilot.copilot_cli_short %} interactively. For automation, you need to do a few things differently:

* Set `GH_ENTERPRISE_TOKEN` (or `GITHUB_ENTERPRISE_TOKEN`) to the {% data variables.product.pat_generic %}.

* Set `GH_HOST` to your server's hostname.

* When both `GH_ENTERPRISE_TOKEN` and `gh auth login` credentials exist for the same host, the environment variable takes precedence.

1. Authenticate the {% data variables.product.company_short %} CLI.

```shell

gh auth login --hostname YOUR-GHES-HOSTNAME

```

1. Set the following environment variables:

```shell

export COPILOT_PROVIDER_GHES_HOST=YOUR-GHES-HOSTNAME

export COPILOT_PROVIDER_GHES_TOKEN="$(gh auth token --hostname YOUR-GHES-HOSTNAME)"

export COPILOT_OFFLINE=true

```

If you are authenticated with `gh auth login` to multiple accounts, you can set `GH_HOST` to your server's hostname and set `GH_ENTERPRISE_TOKEN` (or `GITHUB_ENTERPRISE_TOKEN`) to `"$(gh auth token --hostname YOUR-GHES-HOSTNAME)"`. This ensures {% data variables.product.prodname_cli %} targets your {% data variables.product.prodname_ghe_server %} instance.

```shell

export GH_HOST=YOUR-GHES-HOSTNAME

export GH_ENTERPRISE_TOKEN="$(gh auth token --hostname YOUR-GHES-HOSTNAME)"

```

1. {% data reusables.copilot.copilot-cli.start-cli %}

You can run this entire set-up as a script.

If both {% data variables.product.prodname_ghe_server %} and your {% data variables.copilot.copilot_cli_short %} configurations are correct, then you should see responses like the following in your {% data reusables.copilot.copilot-cli.start-cli %} session.

• fabric-core-mcp — disabled

• powerbi-mcp — disabled

• slack — connected

● Current model: gpt-5.5

❯ Hello 13:31

● Hello!

❯ what is going on in github/codeql-action repo? 13:33

● I’ll check recent repository activity on the GHES host: repo metadata, open

PRs/issues, and latest commits.

$ Shell Fetch repo metadata 2 lines… 5s

gh api --hostname "$GH_HOST" repos/github/codeql-action --jq '{name_with_own…