OIDC tokens

You can use OIDC to authenticate RWX with third-party services. In general, you should use OIDC when it's available. It's more secure than generating access tokens, which could be lost or stolen.

To use OIDC, you will need to configure a token in the OIDC Tokens tab of the RWX Vault UI. After setting the name and audience in the UI, you'll see copyable audience and subject values that you can copy to your service provider. See documentation below for specific instructions for each service provider.

You can then reference the token in RWX run definitions like this:

${{ vaults.your-vault.oidc.your-token-name }}

This expression resolves to a token when RWX prepares the task. The token does not change while the task runs.

Automatically refreshed token files

For long-running tasks, reference the token's path instead:

tasks:
  - key: deploy
    run: third-party-cli deploy
    env:
      OIDC_TOKEN_FILE: ${{ vaults.your-vault.oidc.your-token-name.path }}

RWX writes an initial token before the task starts and provides the task with a stable, read-only file path. RWX replaces the file's contents before the token expires, without changing the path, and continues retrying if a refresh fails.

Configure your credential provider, SDK, or CLI to read the file again whenever it needs a token. A process that reads the file once or keeps it open will not receive the refreshed contents. RWX scrubs both current and recently rotated token values from task logs.

If you're using OIDC for deployment, you'll most likely want to configure the OIDC token in a locked vault. For more details, see the documentation on vaults.

Specific documentation for relying parties

Review these guides to authenticate from RWX to some of the most popular services using OIDC.

RWX OIDC with AWS

RWX OIDC with Depot

RWX OIDC with Google Cloud

RWX OIDC with Azure

RWX OIDC with Namespace

Claims

If you're a service looking to validate an RWX OIDC token, review the following claims: