nsc auth exchange-oidc-token exchanges a third-party OIDC token for a Namespace-scoped token. The token’s issuer and subject claims are matched against a configured trust relationship for your workspace; if a match is found, nsc mints a Namespace token with whatever grants that trust relationship allows.
This is the CLI-side counterpart to nsc auth trust-relationships add — a trust relationship must already exist for the token’s issuer and subject pattern before an exchange can succeed. This makes it useful for CI/CD systems and other external identity providers that can mint OIDC tokens (e.g. GitHub Actions, Buildkite, fly.io, GCP) but don’t otherwise have a Namespace identity.
Usage
Example
Options
—tenant_id string
What tenant to authenticate. Use this to target a specific tenant when your account has access to more than one and the token exchange would otherwise be ambiguous.—token string
The OIDC token to use for authentication. This is typically read from an environment variable or file provided by the external identity provider (e.g. a CI system’s OIDC token endpoint), and its issuer/subject must match an existing trust relationship.Related Topics
- nsc auth trust-relationships add - Configure the trust relationship this command exchanges against
- nsc auth trust-relationships - Manage trust relationships