Skip to main content
August 3, 2026

​
OIDC federation

Instead of saving a long-lived secret, any workload with an OIDC provider can be trusted by Nuon to fetch short-lived access tokens. This works for CI/CD pipelines, Kubernetes workloads, cloud compute, and any other trusted OIDC issuer. You control which providers to trust with a trust policy: which issuer to accept, which token claims to require (such as a repository, branch, service account, or cloud identity), and which role and token lifetime to grant. Manage trust policies from the OIDC federation page in the dashboard or with the CLI. When creating a trust policy, you can select either Github Actions or a Custom provider.
The Create OIDC trust policy modal with the GitHub Actions provider preset selected and a repository picker
Creating the same policy using the CLI:
See OIDC federation for the full model and supported providers.

​
Using with GitHub Actions

Trust policies can also be managed for each repo in your GitHub VCS connection settings, by clicking on the Manage OIDC button.
The Manage OIDC modal on a GitHub connection, listing a repository's trust policies with enable and delete controls
Set the id-token: write permission to enable Github Action’s OIDC provider. The CLI detects if it’s running in GitHub Actions, and will automatically use the OIDC provider if not provided a static token.
See the GitHub Actions guide for more details, and how to use OIDC with the CLI on other platforms.