A walkthrough shows how to use the GitHub Copilot SDK's Bring Your Own Key (BYOK) feature in C# to route model inference to a custom Microsoft Foundry or Azure OpenAI deployment while keeping the Copilot agent runtime. The sample, part of Generative AI for Beginners .NET, is a .NET 10 console app that configures a ProviderConfig with OpenAI-compatible settings, authenticates via Microsoft Entra ID (AzureCliCredential) by default or an API key as fallback, starts the local Copilot CLI runtime via stdio, creates a minimal session with tools and skills disabled, and sends a single prompt to verify the custom model responds correctly.
Table of contents
What BYOK means in this sample Copy linkThe project Copy linkStep 1: read the model configuration Copy linkStep 2: configure the provider Copy linkStep 3: use Entra ID by default Copy linkStep 4: use an API key when one is configured Copy linkStep 5: start the Copilot runtime Copy linkStep 6: create a deliberately small session Copy linkStep 7: send one question Copy linkRun the sample Copy linkSo, what did we actually learn here? Copy linkLearn more Copy linkQuestions this post answers
How do I configure the GitHub Copilot SDK in C# to use my own Microsoft Foundry model deployment instead of the default provider?
Create a ProviderConfig with Type set to "openai", BaseUrl pointing to the Foundry endpoint normalized to end in /openai/v1/, WireApi set to "responses", and ModelId/WireModel set to the deployment name. Pass this provider into SessionConfig alongside the model name when calling CreateSessionAsync. The Copilot runtime still handles the client and session, only inference is routed to Foundry. daily.dev surfaces more walkthroughs like this for developers wiring custom model providers into agent SDKs.
How do I authenticate to Microsoft Foundry from a GitHub Copilot SDK app without hardcoding an API key?
Use AzureCliCredential from the Azure.Identity package to reuse the session created by running az login, requesting the scope "https://cognitiveservices.azure.com/.default". Assign an async callback to provider.BearerTokenProvider that fetches and returns the token. The identity needs the Cognitive Services OpenAI User role on the resource; an API key header can be used instead if required. developers avoiding leaked secrets in AI agent configs can track BYOK auth patterns on daily.dev.