nsc auth exchange-oidc-token

Generate a Namespace token from an OIDC token.

nsc auth exchange-oidc-token exchanges a third-party OIDC token for a Namespace-scoped token. The token's issuer and subject claims are matched against a configured trust relationship for your workspace; if a match is found, nsc mints a Namespace token with whatever grants that trust relationship allows.

This is the CLI-side counterpart to nsc auth trust-relationships add — a trust relationship must already exist for the token's issuer and subject pattern before an exchange can succeed. This makes it useful for CI/CD systems and other external identity providers that can mint OIDC tokens (e.g. GitHub Actions, Buildkite, fly.io, GCP) but don't otherwise have a Namespace identity.

Usage

nsc auth exchange-oidc-token [--tenant_id string] [--token string]

Example

$ nsc auth exchange-oidc-token --token "$OIDC_TOKEN"

Options

--tenant_id string

What tenant to authenticate. Use this to target a specific tenant when your account has access to more than one and the token exchange would otherwise be ambiguous.

--token string

The OIDC token to use for authentication. This is typically read from an environment variable or file provided by the external identity provider (e.g. a CI system's OIDC token endpoint), and its issuer/subject must match an existing trust relationship.