nsc auth issue-id-token

nsc auth issue-id-token issues a Namespace-signed ID token (a JWT) that proves your workload's identity to systems outside Namespace. This is the reverse direction of commands like nsc auth exchange-oidc-token: instead of turning an external token into a Namespace credential, it produces a token from Namespace that an external party — such as AWS or GCP — can validate, as part of Workload Federation.

This is a lower-level primitive: commands like nsc aws assume-role wrap this same kind of token exchange to obtain short-lived cloud credentials directly, so you'd typically reach for issue-id-token yourself when integrating with a cloud provider or tool that doesn't have a dedicated nsc command.

Usage

nsc auth issue-id-token [--audience string] [--duration duration] [--output <plain|json>]

Example

$ nsc auth issue-id-token --audience sts.amazonaws.com
eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ0ZW5hbnRfMTIzNDU2Nzg5YWIiLCJhdWQiOiJzdHMuYW1hem9uYXdzLmNvbSIsImlzcyI6Imh0dHBzOi8vZmVkZXJhdGlvbi5uYW1lc3BhY2VhcGlzLmNvbSIsImlhdCI6MTUxNjIzOTAyMn0.tyh-VfuzIxCyGYDlkBA7DfyjrqmSHu6pQ2hoZuFqUSLPNY2N0mpHb3nk5K17HWP_3cYHBw7AhHale5wky6-sVA

Options

--audience string

The audience the ID token should be issued for — the value that appears in the token's aud claim. The receiving party typically expects a specific value here; for example, AWS's OIDC identity provider setup expects sts.amazonaws.com.

--duration duration

How long the issued token should remain valid. Defaults to 0s, which uses the token's default lifetime.

--output, -o <plain|json>

Specifies the output format. Supported values are plain and json. Defaults to plain.

Related Topics

• Workload Federation