Most AI apps quietly become a billing problem. Every user, every retry, all routed through a single shared API key your server owns. What started clean quickly becomes a cost and access-control headache. Here's what most developers miss: if your users already have GitHub Copilot, your Node.js app doesn't need to own the AI layer. It can borrow it. The 𝐆𝐢𝐭𝐇𝐮𝐛 𝐂𝐨𝐩𝐢𝐥𝐨𝐭 𝐒𝐃𝐊 is minimal to set up and gets you a working request in five lines. But the default setup isn't enough for multi-user apps, and that's where it gets interesting. I wrote a two-part series breaking down exactly how to do this right: 𝐏𝐚𝐫𝐭 𝟏 - How the SDK works, how auth resolves, and why a shared server token is the wrong model from day one. 𝐋𝐢𝐧𝐤 𝐭𝐨 𝐏𝐚𝐫𝐭-𝟏 𝐀𝐫𝐭𝐢𝐜𝐥𝐞 𝐢𝐧 𝐟𝐢𝐫𝐬𝐭 𝐜𝐨𝐦𝐦𝐞𝐧𝐭 𝐏𝐚𝐫𝐭 𝟐 - 𝐆𝐢𝐭𝐇𝐮𝐛 𝐎𝐀𝐮𝐭𝐡 𝐢𝐧 𝐄𝐱𝐩𝐫𝐞𝐬𝐬, each user's token locked in an HttpOnly cookie, auth middleware per request, and every Copilot call running under that user's own GitHub identity. 𝐋𝐢𝐧𝐤 𝐭𝐨 𝐏𝐚𝐫𝐭-𝟐 𝐀𝐫𝐭𝐢𝐜𝐥𝐞 𝐢𝐧 𝐭𝐡𝐞 𝐟𝐢𝐫𝐬𝐭 𝐜𝐨𝐦𝐦𝐞𝐧𝐭 Access control that scales. An architecture you won't regret six months later. #GitHub #Copilot #NodeJS #Express #OAuth #AI #TypeScript
Nice write-up, Sharvesh! This feels like an early "bring your own AI" pattern shifting execution to user identity instead of app-owned infrastructure. Interesting direction for dev tooling.
Link to Part - 1 - https://sharveshs.medium.com/build-smarter-node-apps-with-github-copilot-sdk-and-github-auth-part-1-6abee5828b15 Link to Part - 2 - https://sharveshs.medium.com/build-smarter-node-apps-with-github-copilot-sdk-and-github-auth-part-2-564d53d31489