Copilot CLI: switch GitHub accounts without logging out

Copilot CLI keeps every GitHub account you sign in with, so switching accounts is a /user switch away and no logout is involved. /login is how the second account gets in, and /user list shows who is there. A token in COPILOT_GITHUB_TOKEN, GH_TOKEN or GITHUB_TOKEN overrides all of it: while one is exported, Copilot CLI runs as that token's owner whatever you pick.

For how Copilot CLI behaves we went to GitHub's own Authenticating GitHub Copilot CLI and troubleshooting pages, read on 24 October 2026.

Copilot CLI: switch accounts with /user switch#

1. /user at the Copilot CLI prompt names the account in use.
2. /login, or copilot login in a new terminal session, brings in the next account. Its first question is the host: GitHub.com, or GitHub Enterprise Cloud with data residency on a *.ghe.com address. Then you finish in the browser, or with a device code typed at github.com/login/device.
3. /user list shows every account the CLI has stored.
4. /user switch picks between them.

Two copilot login flags help here: --host HOSTNAME points it at a data-residency host, and --web-flow or --device-code chooses the sign-in flow up front. Organisations with SAML single sign-on each show an Authorize button during sign-in; click it for every one Copilot CLI should reach.

Why Copilot CLI keeps using the wrong GitHub account#

Copilot CLI doesn't only look at the accounts you added with /login. It takes the first credential it finds, in this order:

GitHub's page warns that "An environment variable silently overrides a stored OAuth token." In practice, a GH_TOKEN exported in ~/.zshrc for some deploy script means every Copilot session from that shell runs as the token's owner, while /user switch seems to do nothing. To find out whether any of the three is set:

env | grep -E '^(COPILOT_GITHUB_TOKEN|GH_TOKEN|GITHUB_TOKEN)='

unset GH_TOKEN, or the name the grep printed, fixes the current shell. The export in ~/.zshrc or ~/.bashrc is what brings it back in the next terminal, so delete that line as well. Codespaces is the one exception GitHub lists: there, the GITHUB_TOKEN the codespace injects doesn't override an account signed in with /login.

If nothing is set and nothing is stored, Copilot CLI falls back to the account gh is using. In that case gh auth switch changes it, because it switches the active account for a GitHub host, and copilot then picks up the new gh auth token.

A classic token (ghp_…) in one of those variables behaves differently. An interactive session ignores it with a warning that names the variable. copilot -p and other non-interactive runs refuse to start if it is the only credential, with "Error: Classic Personal Access Tokens (ghp_) are not supported by Copilot."

One token per terminal for a work and a personal account#

The variables that cause the wrong-account problem also give you a clean split. The token comes from github.com, created while you're signed in as the account you want: a fine-grained personal access token with the Copilot Requests permission, whose owner is that personal account, not an organisation. Then start Copilot in that terminal with it:

COPILOT_GITHUB_TOKEN=github_pat_... copilot

That terminal runs as the token's owner, whatever /user switch says elsewhere. Copilot CLI accepts gho_ OAuth tokens, github_pat_ fine-grained tokens and ghu_ GitHub App user tokens; it rejects ghp_.

To separate more than the account, point COPILOT_HOME at a second folder. Copilot CLI keeps its settings, session history, logs, plugins and MCP servers in one folder, ~/.copilot by default, and the configuration directory reference says a new folder starts empty: your existing settings, session history, plugins and saved permissions aren't found there until you copy them over.

Copilot CLI logout: what /logout removes#

/logout deletes the copy of the token on your computer but doesn't revoke it, so the token stays valid on GitHub until you do. That happens on github.com under Settings › Applications › Authorized OAuth Apps, where Copilot CLI's sign-in is listed as GitHub CLI: open its menu and choose Revoke. gh signs in under that same name, so check gh auth status afterwards and sign in again if it asks.

On a Mac, security find-generic-password -s copilot-cli shows whether a stored sign-in is still there. If one is present and sign-in still fails, GitHub's fix is security delete-generic-password -s copilot-cli and a fresh copilot login.

Does copilot --resume follow the account?#

Local sessions sit in session-state/ inside the configuration folder, one subfolder per session ID, not under an account. /user switch doesn't move them, and copilot --resume opens a picker of your recent sessions. GitHub's session data page doesn't say what happens when you resume, under a second account, a session the first one started. It does say sessions are synced to your GitHub account by default (on a Business or Enterprise seat, only if the organisation's policy allows it), and that synced data "is tied to your personal account", so the online copy stays with whoever was signed in. A separate COPILOT_HOME gives each account its own history.

"Access denied by policy settings" with a work account#

A policy or the account's Copilot plan is blocking Copilot CLI when you see this. GitHub's troubleshooting page gives three causes: the organisation restricts Copilot access, your Copilot plan doesn't include the feature, or an administrator hasn't turned on a required policy. Start by confirming the account has an active Copilot licence. After that it is up to the organisation's admin, who enables Copilot CLI in the organisation's Copilot policies. If your other account has a Copilot plan of its own, /user switch to it and carry on in the meantime.

403 Forbidden comes from the same licence and policy checks. 401 is a different problem: the token was revoked, has expired or lacks permissions.

VS Code: Copilot with a work and a personal account#

VS Code doesn't share Copilot CLI's account list. Its Copilot setup page offers two ways:

1. Per workspace: open the Accounts menu in the Activity Bar, choose Manage Extension Account Preferences, pick GitHub Copilot Chat and choose the account. VS Code saves it per workspace and per profile, which is the case it names: "different accounts for work and personal projects".
2. Change the account outright: sign out of the current account in the Accounts menu, then run GitHub Copilot: Sign in from the Command Palette and pick the other one.

Is it allowed to have two GitHub accounts?#

GitHub's Terms of Service say "One person or legal entity may maintain no more than one free Account" (one free machine account is allowed on top), and "Your login may only be used by one person". Only add accounts you own and are entitled to use; providers' terms may not allow sharing a subscription sign-in.

How Shuriken handles several Copilot accounts#

Shuriken is a harness that runs 67 coding agents, GitHub Copilot among them, on your own computers. Each Copilot account you add is a source with its own COPILOT_HOME, so each one has its own Copilot configuration folder and its own sign-in. You choose the account Copilot runs on with Use in Sources, instead of typing /user switch. Signing in runs copilot in a terminal in the app, where the github.com/login/device link appears; you can also add a token instead, which Shuriken hands to Copilot in COPILOT_GITHUB_TOKEN and GH_TOKEN. Your mcp-config.json, agents and skills from ~/.copilot are linked into every source's folder, so each account sees the same MCP servers and skills.

For a source added as a token, Shuriken reads the plan name and the quota reset date from GitHub (the copilot_plan and quota_reset_date fields of api.github.com/copilot_internal/user); it reads no usage percentage for Copilot. The Free plan holds two sources, enough for a work and a personal Copilot account. The same pattern for every other CLI is in multiple accounts in every coding agent CLI, Claude's version is switching Claude accounts without logging out, and the plans side by side are in GitHub Copilot vs Claude Code. To try it with your own accounts, download Shuriken.