> For the complete documentation index, see [llms.txt](https://docs.warp.dev/llms.txt).
> Markdown versions of each page are available by appending .md to any URL.

# Federated identity tokens

Issue short-lived OIDC identity tokens from a running agent so it can authenticate to cloud providers without long-lived credentials.

Caution

The Oz CLI (the `oz` binary) is being deprecated in favor of the Warp Agent CLI (the `warp` binary). `oz` commands remain supported through the end of September 2026. See the [Warp Agent CLI docs](https://docs.warp.dev/agents/cli/) for what is available today.

`oz federate` issues short-lived OIDC identity tokens for the agent that’s currently running. Use these tokens to authenticate to cloud providers (AWS, GCP, Azure, and other OIDC-aware systems) without baking long-lived credentials into your environment.

This command can only be called from inside a running agent session — typically as part of a [skill](https://docs.warp.dev/agents/capabilities/skills/), a tool, or a script the agent executes while a run is in progress.

## When to use federation

Use federated identity tokens when you want an agent to act against a cloud account without storing service-account keys, access keys, or refresh tokens in the environment.

-   **Short-lived credentials** - Tokens expire on a schedule you choose. Even if a token leaks, its blast radius is bounded.
-   **No secret rotation** - Federation removes the need to rotate static keys in environments or secrets.
-   **Per-run identity** - Each run can claim a different subject (user, team, environment, skill, run ID), giving you fine-grained IAM policies.

For background on federation, see your cloud provider’s workload identity federation guide (for example, [Google Cloud’s workload identity federation](https://cloud.google.com/iam/docs/workload-identity-federation) or [AWS IAM Identity Center](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html)).

## `oz federate issue-token`

Issue an OIDC identity token for the current run.

```bash
oz federate issue-token \
  --run-id <RUN_ID> \
  --audience <AUDIENCE> \
  [--duration <DURATION>] \
  [--subject-template <COMPONENT> ...]
```

### Flags

-   **`--run-id <RUN_ID>`** - The ID of the cloud agent run requesting the token. Cloud agent runs set `OZ_RUN_ID` to the current run ID, but you must still pass this flag.
-   **`--audience <AUDIENCE>`** - The `aud` claim for the issued token. Set this to the value your cloud provider’s identity pool expects (for example, an AWS IAM Identity Center audience or a GCP workload identity pool URL).
-   **`--duration <DURATION>`** - Requested token lifetime from 5 minutes to 3 hours. Accepts human-readable durations such as `30m` or `2h30m` and defaults to `1h`.
-   **`--subject-template <COMPONENT> ...`** - Controls how the OIDC token’s `sub` claim is formatted. Pass one or more components, which are joined to form the subject. Defaults to `principal` (for example, `user:my-user-id`).

### Subject template components

By default, `oz federate issue-token` builds `sub` from `principal`. The result is `user:USER_UID` for a user or `service_account:SERVICE_ACCOUNT_UID` for an agent.

Pass each component as a separate argument. Do not quote the whole list. The command joins components in the order you supply them and separates them with commas. It fails if a component isn’t available for the current principal or run. Colons and commas within component values become underscores.

Use `principal`, `scoped_principal`, or any available claim listed under [principal claims](https://docs.warp.dev/platform/integrations/cloud-providers/#principal-claims) and [run claims](https://docs.warp.dev/platform/integrations/cloud-providers/#run-claims), except `user` and `service_account`. Use `principal` in place of those emitted claim names. See [the subject claim](https://docs.warp.dev/platform/integrations/cloud-providers/#subject-sub) for the `principal` and `scoped_principal` formats.

### Examples

Issue a one-hour token with the default `principal` subject:

```bash
oz federate issue-token \
  --run-id "$OZ_RUN_ID" \
  --audience AUDIENCE \
  --output-format json
```

Replace `AUDIENCE` with the identifier expected by your provider.

Issue a 30-minute token whose subject includes the principal, run, and environment:

```bash
oz federate issue-token \
  --run-id "$OZ_RUN_ID" \
  --audience AUDIENCE \
  --duration 30m \
  --subject-template principal run_id environment
```

For a user, this template produces a subject such as `user:abc123,run_id:run-456,environment:env-789`.

## Using tokens with cloud providers

Once you have a token, exchange it for cloud credentials using your provider’s standard OIDC federation flow. The exchange happens between the cloud provider and your script — the Automation Platform only issues the OIDC token.

For provider setup instructions and the complete token claim reference, see [Cloud providers](https://docs.warp.dev/platform/integrations/cloud-providers/).

A typical AWS flow:

1.  Run `oz federate issue-token` to get the OIDC JWT.
2.  Call `sts:AssumeRoleWithWebIdentity` with the JWT and an IAM role ARN.
3.  Use the temporary AWS credentials returned by STS.

A typical GCP flow:

1.  Run `oz federate issue-token` to get the OIDC JWT.
2.  Call the [Security Token Service `token` endpoint](https://cloud.google.com/iam/docs/reference/sts/rest/v1/TopLevel/token) to exchange the JWT for a federated access token.
3.  Optionally impersonate a service account for the final credentials.

## Related

-   [Cloud environments](https://docs.warp.dev/platform/environments/) - configure the environment your agent runs in.
-   [Secrets](https://docs.warp.dev/platform/secrets/) - alternative for credentials that can’t be federated.