> ## Documentation Index
> Fetch the complete documentation index at: https://namespace.so/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# nsc auth issue-id-token

Generate a Namespace ID token to authenticate with cloud providers.

`nsc auth issue-id-token` issues a Namespace-signed ID token (a JWT) that
proves your workload's identity to systems outside Namespace. This is the
reverse direction of commands like `nsc auth exchange-oidc-token`: instead of
turning an external token into a Namespace credential, it produces a token
*from* Namespace that an external party — such as AWS or GCP — can validate,
as part of [Workload Federation](/docs/federation).

This is a lower-level primitive: commands like `nsc aws assume-role` wrap
this same kind of token exchange to obtain short-lived cloud credentials
directly, so you'd typically reach for `issue-id-token` yourself when
integrating with a cloud provider or tool that doesn't have a dedicated `nsc`
command.

## Usage

```bash theme={null}
nsc auth issue-id-token [--audience string] [--duration duration] [--output <plain|json>]
```

### Example

```bash theme={null}
nsc auth issue-id-token --audience sts.amazonaws.com
```

```text nocopy Output theme={null}
eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ0ZW5hbnRfMTIzNDU2Nzg5YWIiLCJhdWQiOiJzdHMuYW1hem9uYXdzLmNvbSIsImlzcyI6Imh0dHBzOi8vZmVkZXJhdGlvbi5uYW1lc3BhY2VhcGlzLmNvbSIsImlhdCI6MTUxNjIzOTAyMn0.tyh-VfuzIxCyGYDlkBA7DfyjrqmSHu6pQ2hoZuFqUSLPNY2N0mpHb3nk5K17HWP_3cYHBw7AhHale5wky6-sVA
```

## Options

<h3 id="--audience-string">
  \--audience string
</h3>

The audience the ID token should be issued for — the value that appears in
the token's `aud` claim. The receiving party typically expects a specific
value here; for example, AWS's [OIDC identity provider setup](/docs/federation/aws)
expects `sts.amazonaws.com`.

<h3 id="--duration-duration">
  \--duration duration
</h3>

How long the issued token should remain valid. Defaults to `0s`, which uses
the token's default lifetime.

<h3 id="--output--o-plainjson">
  \--output, -o \<plain|json>
</h3>

Specifies the output format. Supported values are `plain` and `json`.
Defaults to `plain`.

## Related Topics

* [Workload Federation](/docs/federation)