Allow BYOK for business/enterprise users with client_byok policy#308608
Merged
pierceboggan merged 2 commits intomainfrom Apr 9, 2026
Merged
Allow BYOK for business/enterprise users with client_byok policy#308608pierceboggan merged 2 commits intomainfrom
pierceboggan merged 2 commits intomainfrom
Conversation
- Add isClientBYOKEnabled() method to CopilotToken class - Update isBYOKEnabled to allow users with client_byok=1 token flag - Add github.copilot.clientByokEnabled context key for VS Code core model picker Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR extends Copilot Chat BYOK (Bring Your Own Key) enablement to business/enterprise users when their Copilot token includes the client_byok=1 policy flag, aligning the extension-side gating and context keys with existing VS Code core behavior.
Changes:
- Add
CopilotToken.isClientBYOKEnabled()to expose theclient_byoktoken field. - Update BYOK allowlisting to include users with
client_byok=1(still excluding GHE). - Introduce and maintain a new
github.copilot.clientByokEnabledcontext key on authentication changes for VS Code core to consume.
Show a summary per file
| File | Description |
|---|---|
| extensions/copilot/src/platform/authentication/common/copilotToken.ts | Adds a token helper for the client_byok policy flag. |
| extensions/copilot/src/extension/contextKeys/vscode-node/contextKeys.contribution.ts | Sets github.copilot.clientByokEnabled context key based on the current Copilot token. |
| extensions/copilot/src/extension/byok/common/byokProvider.ts | Allows BYOK for business/enterprise users when client_byok=1 is present (and not on GHE). |
Copilot's findings
- Files reviewed: 3/3 changed files
- Comments generated: 1
Comment on lines
+220
to
+222
| isClientBYOKEnabled(): boolean { | ||
| return this.getTokenValue('client_byok') === '1'; | ||
| } |
There was a problem hiding this comment.
Method name isClientBYOKEnabled uses an all-caps acronym in the middle of a camelCase identifier. For consistency with existing token helpers like isMcpEnabled() / isEditorPreviewFeaturesEnabled(), consider renaming to isClientByokEnabled() and updating call sites accordingly.
Contributor
Screenshot ChangesBase: Changed (1)
|
| Before | After |
|---|---|
lramos15
approved these changes
Apr 9, 2026
joshspicer
pushed a commit
that referenced
this pull request
Apr 9, 2026
…8608) - Add isClientBYOKEnabled() method to CopilotToken class - Update isBYOKEnabled to allow users with client_byok=1 token flag - Add github.copilot.clientByokEnabled context key for VS Code core model picker Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
BYOK (Bring Your Own Key) is currently gated to internal and individual Copilot users. Business and enterprise users should also be able to use BYOK when their organization has opted in via the
client_byokpolicy (token fieldclient_byok=1).Approach
Three changes in the copilot extension, mirroring what's already wired up on the VS Code core side (
chatEntitlementService,chatModelsWidget):CopilotToken.isClientBYOKEnabled()— New method that readsclient_byokfrom the token, following the same pattern asisMcpEnabled()/isEditorPreviewFeaturesEnabled().isBYOKEnabled()update — AddscopilotToken.isClientBYOKEnabled()to the allowlist so business/enterprise users with the policy can use BYOK providers.github.copilot.clientByokEnabledcontext key — Set fromcontextKeys.contribution.tson auth change, following the exactpreviewFeaturesDisabledContextKeypattern. This context key is already read bychatEntitlementService.clientByokEnabledin VS Code core to gate the "Add Models" button for managed entitlements.Testing
client_byok=1in their token should see BYOK providers enabled and the "Add Models" button active in the model picker.