github-actions changedmanage-claude/wif-providers/github-actions
Nearest release: v2.1.309, published 3 hours before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+45added
Lines−45removed
From line
170
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits12to this page, all time
The whole hunk
from line 170, old and new numbered
/
from line 170
170170 }'
171171 ```
172172
173 ```bash CLI
174 # Reads ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID,
175 # ANTHROPIC_SERVICE_ACCOUNT_ID, ANTHROPIC_WORKSPACE_ID, and ANTHROPIC_IDENTITY_TOKEN_FILE
176 # from the job environment.
177 ant messages create \
178 --model claude-opus-5-5 \
179 --max-tokens 1024 \
180 --message '{role: user, content: "Hello, Claude"}'
181 ```
182
173183 ```python Python
174184 import anthropic
175185
from line 216
206216 }
207217 ```
208218
219 ```csharp C#
220 // Reads ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID,
221 // ANTHROPIC_SERVICE_ACCOUNT_ID, ANTHROPIC_WORKSPACE_ID, and ANTHROPIC_IDENTITY_TOKEN_FILE
222 // from the job environment.
223 using var client = new AnthropicClient();
224
225 var message = await client.Messages.Create(new()
226 {
227 Model = Model.ClaudeOpus5_5,
228 MaxTokens = 1024,
229 Messages = [new UserMessageParam { Content = "Hello, Claude" }],
230 });
231 foreach (var block in message.Content)
232 {
233 if (block.Value is TextBlock textBlock)
234 {
235 Console.WriteLine(textBlock.Text);
236 }
237 }
238 ```
239
209240 ```go Go
210241 // Reads ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID,
211242 // ANTHROPIC_SERVICE_ACCOUNT_ID, ANTHROPIC_WORKSPACE_ID, and ANTHROPIC_IDENTITY_TOKEN_FILE
from line 265
234265 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
235266
236267 var message = client.messages().create(MessageCreateParams.builder()
237 .model(Model.CLAUDE_OPUS_5_5)
238 .maxTokens(1024)
239 .addUserMessage("Hello, Claude")
240 .build());
268 .model(Model.CLAUDE_OPUS_5_5)
269 .maxTokens(1024)
270 .addUserMessage("Hello, Claude")
271 .build());
241272
242273 IO.println(message.content());
243274 ```
244275
245 ```csharp C#
246 // Reads ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID,
247 // ANTHROPIC_SERVICE_ACCOUNT_ID, ANTHROPIC_WORKSPACE_ID, and ANTHROPIC_IDENTITY_TOKEN_FILE
248 // from the job environment.
249 using var client = new AnthropicClient();
250
251 var message = await client.Messages.Create(new()
252 {
253 Model = Model.ClaudeOpus5_5,
254 MaxTokens = 1024,
255 Messages = [new UserMessageParam { Content = "Hello, Claude" }],
256 });
257 foreach (var block in message.Content)
258 {
259 if (block.Value is TextBlock textBlock)
260 {
261 Console.WriteLine(textBlock.Text);
262 }
263 }
264 ```
265
266 ```bash CLI
267 # Reads ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID,
268 # ANTHROPIC_SERVICE_ACCOUNT_ID, ANTHROPIC_WORKSPACE_ID, and ANTHROPIC_IDENTITY_TOKEN_FILE
269 # from the job environment.
270 ant messages create \
271 --model claude-opus-5-5 \
272 --max-tokens 1024 \
273 --message '{role: user, content: "Hello, Claude"}'
274 ```
275
276276 ```php PHP
277277 use Anthropic\Client;
278278
from line 311
311311
312312## Verify the setup
313313
314A successful exchange returns an `access_token` beginning with `sk-ant-oat01-` and an `expires_in` value in seconds. A denied exchange returns an opaque `401` `authentication_error` with the fixed message `Authentication failed`, whichever check failed; in most cases the deny reason is recorded on the attempt's entry in the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console, and [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange) walks the checks in order. The most common GitHub Actions-side cause is the `sub` claim format not matching (its trailing segment varies among `ref:...`, `environment:...`, and `pull_request` events); the history entry shows reason `match_subject_prefix`.
314A successful exchange returns an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. A denied exchange returns an opaque `401` `authentication_error` with the fixed message `Authentication failed`, whichever check failed; in most cases the deny reason is recorded on the attempt's entry in the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console, and [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange) walks the checks in order. The most common GitHub Actions-side cause is the `sub` claim format not matching (its trailing segment varies among `ref:...`, `environment:...`, and `pull_request` events); the history entry shows reason `match_subject_prefix`.
315315
316316## Restrict which workflows can authenticate
317317
No line in this hunk matches that.