Other CI platforms
Connect your pipeline through any of the 62 OIDC platforms in our catalog, hand the platform token to penv, or enter a trust by hand.
Your pipeline authenticates with the OIDC token its platform mints. Identities, trusts and credential kinds: machine identity. The console flow: Connect a Platform.
Platforms
Machine Identities then Connect a Platform. Each card asks for your workload's identifying fields; we build the issuer and subject, create the identity and print a snippet. Fields and snippet per platform:
| Kind | Platforms |
|---|---|
| Hosted CI | GitHub Actions, GitLab CI, CircleCI, Buildkite, Bitbucket Pipelines, Bitrise, RWX, Codefresh, Namespace, Depot CI |
| Self-hosted CI | GitHub Enterprise Server, GitHub Enterprise Cloud (data residency), Forgejo Actions, Jenkins, TeamCity, Concourse, Zuul |
| Kubernetes | Kubernetes, GKE, EKS, AKS, OKE, ROSA, Alibaba Cloud ACK, ARO, CoreWeave, Azure Arc, Gardener, STACKIT SKE, Nebius |
| Infrastructure as code | HCP Terraform, Scalr |
| Deployment | Octopus Deploy |
| Workload identity | SPIFFE and SPIRE, Teleport Workload Identity, HashiCorp Vault, HashiCorp Nomad, Defakto, AWS outbound identity federation |
| Hosting | Vercel, Deno Deploy, Fly.io, Ona, Devin, Cursor Cloud Agents |
| Identity provider | Auth0, Okta, Keycloak, authentik, Curity, PingFederate, Ory, Authelia, FusionAuth, Duende IdentityServer, Janssen, Asgardeo, WSO2 Identity Server, Pocket ID, Gravitee Access Management, LemonLDAP::NG, PingOne Advanced Identity Cloud |
A host with no issuer (Bare VPS) binds a keypair instead: a host that proves nothing.
The token's audience must be your workspace id and nothing else. The rule and its failure mode: CI builds. We match subjects byte for byte, with no wildcards.
Your self-hosted issuer must be reachable from the internet. We read signing keys from the issuer's own origin and refuse a discovery document that points elsewhere.
Hand penv the token
PENV_OIDC_TOKEN="$THE_TOKEN" penv run -- npm run deploypenv run starts the command with the values in the child process. The credential we issue lasts fifteen minutes, capped by the trust's own expiry, and reads one project and one environment only. Variables: environment variables.
No catalog entry
Enter the issuer, audience and subject by hand on the identity's page. We warn when an issuer's subject names a shared identity (Google service accounts, Azure managed identities). See Connect a Platform.
Procedure
Open Machine Identities then Connect a Platform and pick the platform.
Fill in the fields. Read back the issuer and subject the console shows.
Copy your workspace id. Configure the platform to mint a token with that audience only.
Put the token in PENV_OIDC_TOKEN, or exchange it and put the credential in PENV_TOKEN.
Run the job. 401 unauthorized means the subject does not match the trust. See errors.