Connect a platform
Per-platform pages for OIDC machine identity: what proves the identity, the console fields, and the snippet the console prints.
We exchange your platform-signed token for a 15-minute credential; no key sits on your runner. Concept: machine identity. Console procedure: connect a platform. One pipeline end to end: connect your CI.
Each page in this section lists what proves the identity, the console fields, the resulting trust, and the snippet the console prints.
Connect and integrations
| Section | Credential holder | What moves |
|---|---|---|
| Connect a platform | None | A token proving a machine's identity |
| Integrations | We hold one for the other system | Values, in or out |
The two share no registry.
Matching rules
| Rule | Detail |
|---|---|
| One audience | Your workspace id, and only that. See values in a CI build. |
| One exact subject | We compare it byte for byte, no wildcards. Our console builds the string from the workload you name. Platforms that put the run or the triggering person in sub have a different claim pinned; each page names the compared claim. |
Bare VPS
Bare VPS has no issuer, subject, or audience. Your host holds its own key and both sides count every login. Our console shows that card only where our deployment holds a challenge secret. See a host that proves nothing.
The sidebar lists every platform in the console grid's order.