workload-identity-federation changedmanage-claude/workload-identity-federation
Nearest release: v2.1.301, published 5 hours before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+21added
Lines−9removed
From line
89
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits15to this page, all time
The whole hunk
from line 89, old and new numbered
/
from line 89
8989
9090You can construct the client with explicit credentials or with no arguments. With no arguments, the SDK resolves credentials from environment variables or the active profile, as described under [Credential precedence](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation#credential-precedence). The zero-argument form is the recommended pattern for production workloads: ship the same container image everywhere and inject `ANTHROPIC_FEDERATION_RULE_ID`, `ANTHROPIC_ORGANIZATION_ID`, `ANTHROPIC_SERVICE_ACCOUNT_ID`, `ANTHROPIC_WORKSPACE_ID`, and `ANTHROPIC_IDENTITY_TOKEN_FILE` per environment.
9191
92<CodeGroup exclude="shell:CLI">
92<CodeGroup>
9393 ```bash cURL
9494 # 1. Acquire your IdP's JWT (platform-specific; see the per-provider guides).
9595 JWT=$(cat /var/run/secrets/anthropic.com/token)
from line 110
110110 )
111111
112112 ACCESS_TOKEN=$(jq -r .access_token <<<"$RESPONSE")
113 EXPIRES_IN=$(jq -r .expires_in <<<"$RESPONSE") # seconds; re-exchange before this elapses
113 # The response's expires_in is the token's lifetime in seconds; re-exchange before it elapses.
114114
115115 # 3. Call the API with the access token in the Authorization: Bearer header.
116116 curl -sS https://api.anthropic.com/v1/messages \
from line 117
117117 -H "authorization: Bearer $ACCESS_TOKEN" \
118118 -H "anthropic-version: 2023-06-01" \
119119 -H "content-type: application/json" \
120 -d @- <<'JSON' | jq -r '.content[] | select(.type == "text") | .text'
121 {
122 "model": "claude-opus-5-5",
123 "max_tokens": 1024,
124 "messages": [{"role": "user", "content": "Hello, Claude"}]
125 }
126 JSON
120 -d '{
121 "model": "claude-opus-5-5",
122 "max_tokens": 1024,
123 "messages": [{"role": "user", "content": "Hello, Claude"}]
124 }'
125 ```
126
127 ```bash CLI
128 # The CLI exchanges the identity token for an access token itself.
129 export ANTHROPIC_IDENTITY_TOKEN_FILE=/var/run/secrets/anthropic.com/token
130 export ANTHROPIC_FEDERATION_RULE_ID=fdrl_...
131 export ANTHROPIC_ORGANIZATION_ID=00000000-0000-0000-0000-000000000000
132 export ANTHROPIC_SERVICE_ACCOUNT_ID=svac_...
133 export ANTHROPIC_WORKSPACE_ID=wrkspc_...
134
135 ant messages create \
136 --model claude-opus-5-5 \
137 --max-tokens 1024 \
138 --message '{role: user, content: "Hello, Claude"}'
127139 ```
128140
129141 ```python Python
No line in this hunk matches that.