Connect a platform
Your CI logs in like a person does, with no key to steal, because the platform already signs a token that names the job.
Your CI logs in like a person does, with no key to steal. The platform your job runs on already signs a short-lived token that says which job is asking. penv trades that token for a fifteen-minute credential, so nothing sits on the runner for anyone to copy.
This section has one page per platform: what proves the identity, what the console asks you for, and the snippet it prints.
How Connect differs from a sync
| Section | Who holds the credential | What moves |
|---|---|---|
| Connect a platform | Nobody holds one | A token that proves who a machine is |
| Integrations | penv holds one for the other system | Values, in or out |
A connection is about moving secrets into a store. Connect is about something outside proving who it is. The two share no registry, because one of them would have to lie about the other's shape.
Two rules decide whether it works
One audience. Every token has to name your workspace id as its audience, and that one only. A token requested for two audiences fails every exchange, because penv refuses a list rather than picking one out of it.
One exact subject. penv compares the subject byte for byte, with no wildcards. That is why the console builds the string from what you name instead of asking you to type it. Several platforms put the run or the person who triggered it in sub, so penv pins a different claim there. Each page says which claim it compares.
Never assemble a subject by hand. A typo produces a trust that looks healthy and never matches a token.
A host that can prove nothing
Bare VPS is the one entry with no issuer, no subject and no audience. A plain VPS signs no metadata and exposes no secure element, so the host holds a key of its own and both sides count every login instead.
Start here
- Connect your CI: one pipeline, end to end.
- Machine identity: identities, credentials and trusts, and why a machine is never a seat.
- Connect a Platform in the console: where you do it.
The list beside this page carries every platform, in the order the console's grid renders them. Bare VPS is the exception: the grid shows that card only where the deployment holds a challenge secret.