Connect a Platform
Create a machine identity with its OIDC trust written from the chosen platform and workload, and print the snippet.
Path: Machine Identities > Connect a Platform (/identities/connect). Pick a platform and answer the questions that identify your workload; we create a machine identity with its trust written and print a snippet. We store no secret, and nothing counts against your plan.
Catalog
62 platforms that mint a signed token naming the workload, in a fixed order with no groups. Each Connect opens a form that builds issuer and subject from your answers.
- Connected: a card for each platform at least one of your identities trusts, with that count. The count opens All Identities filtered to the platform. Shown only when you hold
machine:read; without it we can't count, so we don't claim anything is connected. - All platforms: every other platform as a list, 10 at a time. Show all lists the rest; the search box matches a name or summary.
Catalog order, 1 to 16: GitHub Actions, GitLab CI, CircleCI, Buildkite, Bitbucket Pipelines, Kubernetes, Jenkins, GitHub Enterprise Server, Forgejo Actions, Bitrise, HCP Terraform, GKE, Amazon EKS, AKS, OKE, SPIFFE and SPIRE.
17 to 32: Vercel, Deno Deploy, Fly.io, Ona, Auth0, Keycloak, HashiCorp Vault, HashiCorp Nomad, Teleport Workload Identity, TeamCity, RWX, Okta, Scalr, Devin, GitHub Enterprise Cloud (data residency), authentik.
33 to 48: Red Hat OpenShift Service on AWS, Alibaba Cloud ACK, Azure Red Hat OpenShift, CoreWeave Kubernetes Service, Azure Arc-enabled Kubernetes, Gardener, STACKIT Kubernetes Engine, Octopus Deploy, Concourse, Codefresh, Namespace, AWS outbound identity federation, Defakto, Zuul, Curity Identity Server, PingFederate.
49 to 62: Depot CI, Cursor Cloud Agents, Ory, Authelia, FusionAuth, Nebius Managed Kubernetes, Duende IdentityServer, Janssen, Asgardeo, WSO2 Identity Server, Pocket ID, Gravitee Access Management, LemonLDAP::NG, PingOne Advanced Identity Cloud.
Never assemble a subject by hand. We match subjects exactly and the formats are unforgiving: a typo produces a trust that looks healthy and never matches a token.
| Card | Behavior |
|---|---|
| GitHub Actions | You pick a repository from a list we read from the GitHub API instead of a form. The button appears only when GitHub Connect is configured on this deployment; otherwise the card describes the platform and offers nothing |
| Google or Azure issuer (hand-entry form) | A warning under the subject field: Google's subject names the service account and Azure's the managed identity, so every host running as it matches one trust |
| Bare VPS | A 53rd entry, shown only when the deployment holds a keypair challenge secret. Without one, nothing enrolled could authenticate, so we hide it. Connect asks for a name, a project and environment, and a role, then creates the identity with a host keypair and shows the enrollment command once |
We accept only tokens that name your workspace id as their audience, and a token requested for two audiences fails every exchange: CI builds.
Bare VPS
For a host with no signed metadata and no secure element: your host generates an Ed25519 key, we keep the public half, and every login advances a counter both sides hold. A copied key works once and then locks both out.
The script this dialog prints belongs to an older setup the current binary no longer uses. Enroll the host with penv machine enroll (see penv machine) and the one-time secret instead: a host that proves nothing.
Snippet
Each snippet keeps the platform token inside one step and one process (CI builds).
Snippets end with penv pull, which writes a file. We recommend penv run instead, which hands values to one child process and writes nothing to disk: connect your CI.
Required permissions
Permission slugs: roles and permissions.
| Action | Needs | Step-up | Recorded as |
|---|---|---|---|
| Open the catalog | machine:create somewhere | No | not recorded |
| Connect a platform | machine:create at the chosen project and environment | Yes. An issuer you run yourself needs two-factor authentication | identity.create, credential.issue |
| List repositories | machine:create | No | not recorded |
| Connect a repository | machine:create at the chosen project and environment | Yes | identity.create, credential.issue |
| Connect a Bare VPS | machine:create at the chosen project and environment | Yes | identity.create, credential.issue |
Every connect asks for step-up, like creating an identity from All Identities: a trust hands no secret over, but it is a standing way in for whoever controls the issuer and subject. A platform whose issuer you run yourself (Kubernetes, a self-managed GitLab, your own identity provider) needs two-factor authentication enrolled and a fresh challenge.
Next: integrations.