BYOK & Local Model Support in Copilot CLI [GA] (#60430)

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Laura Coursen <lecoursen@github.com>
Co-authored-by: hubwriter <hubwriter@github.com>
Co-authored-by: Claire W <78226508+crwaters16@users.noreply.github.com>

Author: 5 people

content/copilot/concepts/agents/copilot-cli/about-copilot-cli.md

@@ -307,6 +307,21 @@ You can change the model used by {% data variables.copilot.copilot_cli %} by usi
 
 Each time you submit a prompt to {% data variables.product.prodname_copilot_short %} in {% data variables.copilot.copilot_cli_short %}'s interactive interface, and each time you use {% data variables.copilot.copilot_cli_short %} programmatically, your monthly quota of {% data variables.product.prodname_copilot_short %} premium requests is reduced by one, multiplied by the multiplier shown in parentheses in the model list. For example, `Claude Sonnet 4.5 (1x)` indicates that with this model each time you submit a prompt your quota of premium requests is reduced by one. For information about premium requests, see [AUTOTITLE](/copilot/concepts/billing/copilot-requests).
 
+### Using your own model provider
+
+You can configure {% data variables.copilot.copilot_cli_short %} to use your own model provider instead of {% data variables.product.github %}-hosted models. This lets you connect to an OpenAI-compatible endpoint, Azure OpenAI, or Anthropic, including locally running models such as Ollama. You configure your model provider using environment variables.
+
+| Environment variable | Description |
+|---|---|
+| `COPILOT_PROVIDER_BASE_URL` | The base URL of your model provider's API endpoint. |
+| `COPILOT_PROVIDER_TYPE` | The provider type: `openai` (default), `azure`, or `anthropic`. The `openai` type works with any OpenAI-compatible endpoint, including Ollama and vLLM. |
+| `COPILOT_PROVIDER_API_KEY` | Your API key for authenticating with the provider. Not required for providers that don't use authentication, such as a local Ollama instance. |
+| `COPILOT_MODEL` | The model to use (required when using a custom provider). You can also set this with the `--model` command-line option. |
+
+Models used with {% data variables.copilot.copilot_cli_short %} must support **tool calling** (function calling) and **streaming**. If the model does not support these capabilities, {% data variables.copilot.copilot_cli_short %} will return an error. For best results, the model should have a context window of at least 128k tokens.
+
+For details on how to configure your model provider, run `copilot help providers` in your terminal.
+
 ## Use {% data variables.copilot.copilot_cli_short %} via ACP
 
 ACP (the Agent Client Protocol) is an open standard for interacting with AI agents. It allows you to use {% data variables.copilot.copilot_cli_short %} as an agent in any third-party tools, IDEs, or automation systems that support this protocol.

content/copilot/how-tos/copilot-cli/administer-copilot-cli-for-your-enterprise.md

@@ -55,6 +55,7 @@ All other controls do **not** affect {% data variables.copilot.copilot_cli_short
 * **Model Context Protocol (MCP) server policies**: Enterprise policies that control whether MCP servers can be used, or which MCP registry servers are allowed
 * **IDE-specific policies**: Policies configured for specific IDEs or editor extensions
 * **Content exclusions**: File path-based content exclusions
+* **User-configured model providers (BYOK)**: Users can configure {% data variables.copilot.copilot_cli_short %} to use their own model providers via environment variables. This is configured at the _user level_ and cannot be controlled by enterprise policies.
 
 ## Why can't my developers access {% data variables.copilot.copilot_cli_short %}?
 

content/copilot/how-tos/copilot-cli/cli-best-practices.md

@@ -104,6 +104,22 @@ Use `/model` to choose from available models based on your task complexity:
 
 You can switch models mid-session with `/model` as task complexity changes.
 
+If your organization or enterprise has configured custom models using their own LLM provider API keys, those models also appear in `/model` at the bottom of the list.
+
+### Use your own model provider
+
+You can configure {% data variables.copilot.copilot_cli_short %} to use your own model provider instead of {% data variables.product.github %}-hosted models. Run `copilot help providers` for full setup instructions.
+
+**Key considerations:**
+
+* Your model must support **tool calling** (function calling) and **streaming**. {% data variables.copilot.copilot_cli_short %} returns an error if either capability is missing.
+* For best results, use a model with a context window of at least 128k tokens.
+* Built-in sub-agents (`/review`, `/task`, explore, `/fleet`) automatically inherit your provider configuration.
+* Premium request cost estimates are hidden when using your own provider. Token usage (input, output, and cache counts) is still displayed.
+* `/delegate` only works if you are also signed in to {% data variables.product.github %}. It transfers the session to {% data variables.product.github %}'s server-side {% data variables.product.prodname_copilot_short %}, not your provider.
+
+See [Using your own model provider](/copilot/concepts/agents/copilot-cli/about-copilot-cli#using-your-own-model-provider).
+
 ## 2. Plan before you code
 
 ### Plan mode

content/copilot/how-tos/copilot-cli/customize-copilot/index.md

@@ -12,6 +12,7 @@ children:
   - /create-skills
   - /add-mcp-servers
   - /create-custom-agents-for-cli
+  - /use-byok-models
   - /plugins-finding-installing
   - /plugins-creating
   - /plugins-marketplace

content/copilot/how-tos/copilot-cli/customize-copilot/use-byok-models.md

@@ -0,0 +1,121 @@
+---
+title: Using your own LLM models in GitHub Copilot CLI
+shortTitle: Use your own model provider
+intro: 'Use a model from an external provider of your choice in {% data variables.product.prodname_copilot_short %} by supplying your own API key.'
+allowTitleToDifferFromFilename: true
+versions:
+  feature: copilot
+contentType: how-tos
+category:
+  - Configure Copilot
+  - Configure Copilot CLI
+---
+
+You can configure {% data variables.copilot.copilot_cli_short %} to use your own LLM provider, also called BYOK (Bring Your Own Key), instead of {% data variables.product.github %}-hosted models. This lets you connect to OpenAI-compatible endpoints, Azure OpenAI, or Anthropic, including locally running models such as Ollama.
+
+## Prerequisites
+
+* {% data variables.copilot.copilot_cli_short %} is installed. See [AUTOTITLE](/copilot/how-tos/copilot-cli/set-up-copilot-cli/install-copilot-cli).
+* You have an API key from a supported LLM provider, or you have a local model running (such as Ollama).
+
+## Supported providers
+
+{% data variables.copilot.copilot_cli_short %} supports three provider types:
+
+| Provider type | Compatible services |
+|---|---|
+| `openai` | OpenAI, Ollama, vLLM, Foundry Local, and any other OpenAI Chat Completions API-compatible endpoint. This is the default provider type. |
+| `azure` | Azure OpenAI Service. |
+| `anthropic` | Anthropic (Claude models). |
+
+For additional examples, run `copilot help providers` in your terminal.
+
+## Model requirements
+
+Models must support **tool calling** (also called function calling) and **streaming**. If a model does not support either capability, {% data variables.copilot.copilot_cli_short %} returns an error. For best results, use a model with a context window of at least 128k tokens.
+
+## Configuring your provider
+
+You configure your model provider by setting environment variables before starting {% data variables.copilot.copilot_cli_short %}.
+
+| Environment variable | Required | Description |
+|---|---|---|
+| `COPILOT_PROVIDER_BASE_URL` | Yes | The base URL of your model provider's API endpoint. |
+| `COPILOT_PROVIDER_TYPE` | No | The provider type: `openai` (default), `azure`, or `anthropic`. |
+| `COPILOT_PROVIDER_API_KEY` | No | Your API key for the provider. Not required for providers that do not use authentication, such as a local Ollama instance. |
+| `COPILOT_MODEL` | Yes | The model identifier to use. You can also set this with the `--model` command-line flag. |
+
+## Connecting to an OpenAI-compatible endpoint
+
+Use the following steps if you are connecting to OpenAI, Ollama, vLLM, Foundry Local, or any other endpoint that is compatible with the OpenAI Chat Completions API.
+
+1. Set environment variables for your provider. For example, for a local Ollama instance:
+
+   ```shell
+   export COPILOT_PROVIDER_BASE_URL=http://localhost:11434
+   export COPILOT_MODEL=YOUR-MODEL-NAME
+   ```
+
+   Replace `YOUR-MODEL-NAME` with the name of the model you have pulled in Ollama (for example, `llama3.2`).
+
+1. For a remote OpenAI endpoint, also set your API key.
+
+   ```shell
+   export COPILOT_PROVIDER_BASE_URL=https://api.openai.com
+   export COPILOT_PROVIDER_API_KEY=YOUR-OPENAI-API-KEY
+   export COPILOT_MODEL=YOUR-MODEL-NAME
+   ```
+
+   Replace `YOUR-OPENAI-API-KEY` with your OpenAI API key and `YOUR-MODEL-NAME` with the model you want to use (for example, `gpt-4o`).
+
+{% data reusables.copilot.copilot-cli.start-cli %}
+
+## Connecting to Azure OpenAI
+
+1. Set the environment variables for Azure OpenAI.
+
+   ```shell
+   export COPILOT_PROVIDER_BASE_URL=https://YOUR-RESOURCE-NAME.openai.azure.com/openai/deployments/YOUR-DEPLOYMENT-NAME
+   export COPILOT_PROVIDER_TYPE=azure
+   export COPILOT_PROVIDER_API_KEY=YOUR-AZURE-API-KEY
+   export COPILOT_MODEL=YOUR-DEPLOYMENT-NAME
+   ```
+   
+   Replace the following placeholders:
+
+     * `YOUR-RESOURCE-NAME`: your Azure OpenAI resource name
+     * `YOUR-DEPLOYMENT-NAME`: the name of your model deployment
+     * `YOUR-AZURE-API-KEY`: your Azure OpenAI API key
+
+{% data reusables.copilot.copilot-cli.start-cli %}
+
+## Connecting to Anthropic
+
+1. Set the environment variables for Anthropic:
+
+   ```shell
+   export COPILOT_PROVIDER_TYPE=anthropic
+   export COPILOT_PROVIDER_API_KEY=YOUR-ANTHROPIC-API-KEY
+   export COPILOT_MODEL=YOUR-MODEL-NAME
+   ```
+
+   Replace `YOUR-ANTHROPIC-API-KEY` with your Anthropic API key and YOUR-MODEL-NAME with the Claude model you want to use (for example, `claude-opus-4-5`).
+
+{% data reusables.copilot.copilot-cli.start-cli %}
+
+## Running in offline mode
+
+You can run {% data variables.copilot.copilot_cli_short %} in offline mode to prevent it from contacting {% data variables.product.github %}'s servers. This is designed for isolated environments where the CLI should communicate only with your local or on-premises model provider.
+
+> [!IMPORTANT] 
+> Offline mode only guarantees full network isolation if your provider is also local or within the same isolated environment. If `COPILOT_PROVIDER_BASE_URL` points to a remote endpoint, your prompts and code context are still sent over the network to that provider.
+
+1. Configure your provider environment variables as described in Configuring your provider.
+
+1. Set the offline mode environment variable:
+
+   ```shell
+   export COPILOT_OFFLINE=true
+   ```
+
+{% data reusables.copilot.copilot-cli.start-cli %}

content/copilot/how-tos/copilot-cli/set-up-copilot-cli/authenticate-copilot-cli.md

@@ -12,14 +12,40 @@ category:
 
 ## About authentication
 
-{% data variables.copilot.copilot_cli %} supports three authentication methods. The method you use depends on whether you are working interactively or in an automated environment.
+If you use your own LLM provider API keys (BYOK), {% data variables.product.github %} authentication is not required.
+
+Authentication is required for any other {% data variables.copilot.copilot_cli %} usage.
+
+When authentication is required, {% data variables.copilot.copilot_cli_short %} supports three methods. The method you use depends on whether you are working interactively or in an automated environment.
 
 * **OAuth device flow**: The default and recommended method for interactive use. When you run `/login` in {% data variables.copilot.copilot_cli_short %}, the CLI generates a one-time code and directs you to authenticate in your browser. This is the simplest way to authenticate.
 * **Environment variables**: Recommended for CI/CD pipelines, containers, and non-interactive environments. You set a supported token as an environment variable (`COPILOT_GITHUB_TOKEN`, `GH_TOKEN`, or `GITHUB_TOKEN`), and the CLI uses it automatically without prompting.
 * **{% data variables.product.prodname_cli %} fallback**: If you have {% data variables.product.prodname_cli %} (`gh`) (note: the `gh` CLI, not `copilot`) installed and authenticated, {% data variables.copilot.copilot_cli_short %} can use its token automatically. This is the lowest priority method and activates only when no other credentials are found.
 
 Once authenticated, {% data variables.copilot.copilot_cli_short %} remembers your login and automatically uses the token for all {% data variables.product.prodname_copilot_short %} API requests. You can log in with multiple accounts, and the CLI will remember the last-used account. Token lifetime and expiration depend on how the token was created on your account or organization settings.
 
+## Unauthenticated use
+
+If you configure {% data variables.copilot.copilot_cli_short %} to use your own LLM provider API keys (BYOK), {% data variables.product.github %} authentication is **not required**. {% data variables.copilot.copilot_cli_short %} can connect directly to your configured provider without a {% data variables.product.github %} account or token.
+
+However, without {% data variables.product.github %} authentication, the following features are **not available**:
+
+* `/delegate`: Requires {% data variables.copilot.copilot_coding_agent %}, which runs on {% data variables.product.github %}'s servers
+* {% data variables.product.github %} MCP server: Requires authentication to access {% data variables.product.github %} APIs
+* {% data variables.product.github %} Code Search: Requires authentication to query {% data variables.product.github %}'s search index
+
+You can combine BYOK with {% data variables.product.github %} authentication to get the best of both: your preferred model for AI responses, plus access to {% data variables.product.github %}-hosted features like `/delegate` and code search.
+
+### Offline mode
+
+ If you set the `COPILOT_OFFLINE` environment variable to `true`, {% data variables.copilot.copilot_cli_short %} runs without contacting {% data variables.product.github %}'s servers. In offline mode:
+
+* No {% data variables.product.github %} authentication is attempted.
+* The CLI only makes network requests to your configured BYOK provider.
+* Telemetry is fully disabled.
+
+Offline mode is **only fully air-gapped** if your BYOK provider is local or otherwise within the same isolated environment (for example, a model running on-premises with no external network access). If `COPILOT_PROVIDER_BASE_URL` points to a remote or internet-accessible endpoint, prompts and code context will still be sent over the network to that provider. Without offline mode, even when using BYOK without {% data variables.product.github %} authentication, telemetry is still sent normally.
+
 ### Supported token types
 
 | Token type                 | Prefix        | Supported | Notes                                                  |
@@ -50,7 +76,8 @@ When you run a command, {% data variables.copilot.copilot_cli_short %} checks fo
 1. GitHub CLI (`gh auth token`) fallback
 
 > [!NOTE]
-> An environment variable silently overrides a stored OAuth token. If you set `GH_TOKEN` for another tool, the CLI uses that token instead of the OAuth token from `copilot login`. To avoid unexpected behavior, unset environment variables you do not intend the CLI to use.
+> * An environment variable silently overrides a stored OAuth token. If you set `GH_TOKEN` for another tool, the CLI uses that token instead of the OAuth token from `copilot login`. To avoid unexpected behavior, unset environment variables you do not intend the CLI to use.
+> * When you configure BYOK provider environment variables (for example, `COPILOT_PROVIDER_BASE_URL`, `COPILOT_PROVIDER_API_KEY`), {% data variables.copilot.copilot_cli_short %} uses these for AI model requests regardless of your {% data variables.product.github %} authentication status. {% data variables.product.github %} tokens are only needed for {% data variables.product.github %}-hosted features.
 
 ## Authenticating with OAuth
 

content/copilot/responsible-use/copilot-cli.md

@@ -107,6 +107,30 @@ You can grant {% data variables.copilot.copilot_cli_short %} specific permission
 
 For more information about security practices while using {% data variables.copilot.copilot_cli %}, see "Security considerations" in [AUTOTITLE](/copilot/concepts/agents/about-copilot-cli#security-considerations).
 
+## Data handling when using your own model provider
+
+When you configure {% data variables.copilot.copilot_cli_short %} to use your own model provider, your prompts, code context, and generated responses are sent directly to the provider you configure. They are not routed through {% data variables.product.github %}. You are responsible for reviewing and complying with the terms of service and data handling policies of your chosen provider.
+
+### Telemetry
+
+When you use your own model provider without offline mode, {% data variables.copilot.copilot_cli_short %} continues to send telemetry to {% data variables.product.github %} as usual. This telemetry does not include your prompts or code, but it does include usage metadata.
+
+If you enable offline mode by setting the `COPILOT_OFFLINE` environment variable to `true`, all telemetry is disabled. In offline mode, {% data variables.copilot.copilot_cli_short %} only makes network requests to your configured model provider.
+
+### Authentication and feature availability
+
+{% data variables.product.github %} authentication is not required when using your own model provider (BYOK). Without {% data variables.product.github %} authentication, the following features are unavailable:
+
+* `/delegate`, which hands off the session to {% data variables.product.github %}'s server-side {% data variables.product.prodname_copilot_short %}
+* The {% data variables.product.github %} MCP server
+* {% data variables.product.github %} Code Search
+
+In offline mode, web-based tools such as `web_fetch` and {% data variables.product.github %} Code Search are also disabled.
+
+### No fallback to {% data variables.product.github %}-hosted models
+
+If your model provider configuration is invalid, {% data variables.copilot.copilot_cli_short %} exits with an error. It does not fall back to {% data variables.product.github %}-hosted models. Common failures, such as connection refused, authentication errors, model not found, and timeouts, produce user-friendly messages with actionable guidance.
+
 ## Limitations of {% data variables.copilot.copilot_cli %}
 
 Depending on factors such as your codebase and input data, you may experience different levels of performance when using {% data variables.copilot.copilot_cli %}. The following information is designed to help you understand system limitations and key concepts about performance as they apply to {% data variables.copilot.copilot_cli %}.

data/reusables/copilot/copilot-cli/start-cli.md

@@ -0,0 +1,5 @@
+1. Start {% data variables.copilot.copilot_cli_short %}.
+
+```bash
+copilot
+```

data/variables/copilot.yml

@@ -199,4 +199,4 @@ copilot_workspace: 'Copilot Workspace'
 copilot_workspace_short: 'Workspace'
 
 # BYOK
-copilot_byok_supported_features: '{% data variables.copilot.copilot_chat %}'
+copilot_byok_supported_features: '{% data variables.copilot.copilot_chat %} and {% data variables.copilot.copilot_cli %}'