Security
OIDC token exchange
Quick answer
OIDC token exchange lets a workflow trade a short-lived GitHub identity token for cloud credentials, with no long-lived secret stored anywhere.
OIDC token exchange lets a workflow trade a short-lived GitHub identity token for cloud credentials, with no long-lived secret stored anywhere.
Why it matters
It is strictly better than storing an access key in repository secrets: the credential cannot be exfiltrated because it does not exist until the job asks for it, and it expires in minutes.
Your next build could be twice as fast, at half the price
Start free. Migrating away is the same one line, and we publish that diff too.
Related
Audit logAn audit log is an append-only record of configuration and access changes, capturing who did what, when, and from where.Data residencyData residency is the requirement that data be stored and processed within a defined geographic boundary.GitHub AppA GitHub App is an integration that authenticates as itself with scoped, short-lived installation tokens rather than as a user.GITHUB_TOKENGITHUB_TOKEN is the automatically generated, short-lived token available to every workflow run for authenticating to the GitHub API.