Windows Copilot API

Setup (2 minutes)

```bash

Install the browser Playwright needs (one-time)

playwright install chromium

Run with Docker (optional)

Prefer a container? You can run the OpenAI-compatible server in Docker once you've signed in.

Sign in on the host first. The login step above opens a visible browser, which can't run inside the headless container — so run python -m copilot login on your host to populate session/. The container mounts that folder and reuses the Cloudflare clearance earned on the host. It refreshes the chat token headlessly, but it can't earn fresh clearance without a visible browser, so when clearance expires (~30 min) it returns a 503 — re-run python -m copilot login on the host to refresh session/.

```bash docker compose up --build

Usage 1: In Python (no server)

The simplest way if your code is already Python.

```python from copilot import CopilotClient

client = CopilotClient() # loads your signed-in session

Usage 2: As an OpenAI-compatible server

Start a local server that speaks the OpenAI API, so existing OpenAI tools and SDKs work unchanged.

```bash python app.py

Windows Copilot API: a free LLM API powered by Microsoft Copilot

Using your own Microsoft Copilot account. No API key, no credits, no paid plan: it turns the free chat at copilot.microsoft.com into an API you can call from code.

You can use it in two ways:

• 🐍 As a Python library: just call client.chat("Hi"). Supports streaming and multi-turn conversations.
• 🔌 As a local OpenAI-compatible API: runs a server at http://localhost:8000/v1 that speaks the OpenAI format, so the official openai SDK (and any OpenAI-compatible app) works as a drop-in, with localhost in place of OpenAI.

You sign in once in a browser with your Microsoft or Google account; your session is saved and refreshed automatically after that.

Unofficial project. Not affiliated with or endorsed by Microsoft. It automates the consumer Copilot web experience for personal use, so use it responsibly and within Microsoft's terms.

---

-> Copilot OpenAI-compatible API on http://localhost:8000

The [docker-compose.yml](docker-compose.yml) maps port `8000` and bind-mounts your `session/` so the login persists across restarts. Tune `RATE_LIMIT_RPM` / `RATE_LIMIT_BURST` there. To run without Compose, build and pass the same bindings by hand:

---

-> Copilot OpenAI-compatible API on http://127.0.0.1:8000

Then point any OpenAI client at it (the API key is required by the SDK but ignored):

client = OpenAI(base_url="http://localhost:8000/v1", api_key="unused")

resp = client.chat.completions.create( model="copilot", messages=[{"role": "user", "content": "Hello!"}], ) print(resp.choices[0].message.content)

Or call it with plain HTTP / `curl`:

Endpoints

Change the address with env vars: HOST=0.0.0.0 PORT=8080 python app.py, or run uvicorn server.api:app --host 0.0.0.0 --port 8080.

👉 More: examples/04_server_http.py, 05_server_stream.py, 06_server_openai_sdk.py

---

Troubleshooting

Cloudflare clearance is handled automatically (see above), so most "verify you're human" issues clear themselves. If a request still fails, run the diagnostic — it refreshes the session and writes a shareable report.

python tests/diagnostic.py                # browser capture + report
python tests/diagnostic.py --report-only  # headless/VPS: report only, no browser

The default run opens your signed-in browser and asks you to send one short message. That single action:

- Refreshes clearance: it drives a real browser on the same session/profile/ the bridge uses, so passing any "verify you're human" check earns a fresh cf_clearance cookie, then snapshots the session (cookies + token) into session/token.json for the pure-HTTP driver to adopt. - Captures the protocol to session/ws_capture.log. A clean turn goes setOptions → send → appendText… → done; a `{"event":"challenge", "method":"cloudflare",…}` frame means Cloudflare gated the turn.

It also writes session/diagnostic_report.txt — environment, the shape of your session (cookie names + token length, never the values), a live chat probe, and redacted log tails. Both files are safe to share: access tokens, cookies, OAuth codes, and emails are redacted before anything is written. Attach diagnostic_report.txt to a GitHub issue (skim it first) and the cause is usually obvious.

On a headless server/VPS you can't open a browser, so clearance can't be earned there — pass --report-only, and do the clearance step on a machine with a display (or route traffic through a residential connection, e.g. a home-PC exit node), since datacenter IPs are where Cloudflare is strictest.

---