Machine identities
Console reference for machine identities: the roster, built-in machine roles, the four credential types, revocation, and required permissions.
Path: Machine Identities > All Identities
Credential kinds, the token exchange, and revocation semantics: Machine identity.
Roster
Columns: identity and platform, the project and environment it reads, role, status, last used. Filter by project or platform, or search by name.
| Tab | Shows |
|---|---|
| Active | Live identities |
| Needs attention | A cloned key, a trust broken by a rename, no live credential, or access ending within 14 days |
| Revoked | Revoked identities |
| All | Every identity |
To create an identity, you give a name, a project and environment, and a role. The binding is fixed at creation; we refuse a request that names any other environment.
Machine roles
| Role | Permissions |
|---|---|
| Secrets Reader | secret:read, secret:reveal, dynamic:generate |
| Secrets Writer | Secrets Reader, plus secret:write and secret:delete |
A custom machine role can withhold any of these, such as dynamic:generate. Machine identities take no seat on your plan; see Billing and plans.
Credentials
Open an identity to see its role and credentials. One dialog, Issue Credential, issues all four credential types.
Select a trust to see How this authenticates beside the list. None of it is secret:
- The pipeline snippet for its platform
- Its issuer
- Its subject
- Its audience
A credential that expires within 14 days with nothing newer of the same kind says so on its card: issue the next one before it lapses.
| Tab | Holds | Secret shown |
|---|---|---|
| Token | A pck_ string with a chosen expiry | Once, at creation |
| OIDC trust | An issuer plus one exactly matched subject | Nothing |
| AWS workload | An account id plus a role's immutable id | Nothing |
| Host keypair | A one-time enrollment secret for penv machine enroll (see penv machine) | Once, at creation |
A token we mint in exchange under a trust lives 15 minutes. Trust setup per platform: Connect a platform.
Revoke
From the identity page you revoke one credential or the whole identity. When a second host presents a host keypair, we treat it as cloned and revoke it with every credential it minted.
Required permissions
Full matrix: Roles and permissions. Step-up: Security and MFA. Except create, every permission applies at the identity's binding.
| Action | Permission | Step-up | Audit entry |
|---|---|---|---|
| Open the roster | machine:read | No | none |
| Create an identity | machine:create at the chosen project and environment | Yes | identity.create |
| Issue a token | machine:issue | Yes | credential.issue |
| Add an OIDC trust | machine:issue | Yes. An issuer you run yourself needs two-factor authentication | credential.issue |
| Add an AWS trust | machine:issue | Yes | credential.issue |
| Enroll a host keypair | machine:issue | Yes | credential.issue |
| Revoke one credential | machine:revoke | No | credential.revoke |
| Revoke the identity | machine:revoke | No | identity.revoke |
Issuing a credential cannot widen an identity's role; you set the role at creation, so machine:issue and machine:create are separate permissions. A token, trust or keypair still hands its holder everything the identity may do, so you can add one only to an identity whose role you hold yourself at its binding.
A trust is a standing way in, so we ask for step-up before writing one. An issuer we do not recognise as a vendor's (a self-managed GitLab, a cluster, your own identity provider) also needs two-factor authentication enrolled. We refuse Penv Cloud's own issuer.
A token, trust or keypair you add while elevated expires when the elevation does, whatever lifetime you chose.
Revoking a trust or a host keypair also revokes every token it minted, at once.
We write two entries on our own:
| System entry | Meaning |
|---|---|
credential.drifted | A trust stopped matching the tokens arriving under it |
credential.cloned | One host keypair authenticated from two places; we lock the credential |
Next: Connect a platform.
Parameters
Console reference for parameters: the key list, setting values, version history, the Schema card, comparing environments, CLI equivalents, and required permissions.
Connect a Platform
Create a machine identity with its OIDC trust written from the chosen platform and workload, and print the snippet.