nsc auth issue-id-token issues a Namespace-signed ID token (a JWT) that
proves your workload’s identity to systems outside Namespace. This is the
reverse direction of commands like nsc auth exchange-oidc-token: instead of
turning an external token into a Namespace credential, it produces a token
from Namespace that an external party — such as AWS or GCP — can validate,
as part of Workload Federation.
This is a lower-level primitive: commands like nsc aws assume-role wrap
this same kind of token exchange to obtain short-lived cloud credentials
directly, so you’d typically reach for issue-id-token yourself when
integrating with a cloud provider or tool that doesn’t have a dedicated nsc
command.
Usage
Example
Output
Options
—audience string
The audience the ID token should be issued for — the value that appears in the token’saud claim. The receiving party typically expects a specific
value here; for example, AWS’s OIDC identity provider setup
expects sts.amazonaws.com.
—duration duration
How long the issued token should remain valid. Defaults to0s, which uses
the token’s default lifetime.
—output, -o <plain|json>
Specifies the output format. Supported values areplain and json.
Defaults to plain.