Replace NODE_UID with the node's UID: changedmanage-claude/wif-providers/spiffe
Recorded here
Lines+5added
Lines−2removed
From line
171
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits20to this page, all time
The whole hunk
from line 171, old and new numbered
/
from line 171
171171
172172## Acquire and use the token
173173
174The SDK can read the JWT-SVID from the file that spiffe-helper maintains or, except in Java, call the SPIFFE Workload API directly through a token provider. The file path takes the least code, and the SDK supports it in every language. The token-provider path removes the sidecar but requires a SPIFFE Workload API client in your application’s language.
174The SDK can get the JWT-SVID in two ways:
175175
176* **From a file.** spiffe-helper keeps the JWT-SVID in a file, and the SDK reads that file. This takes the least code and works in every SDK language.
177* **From a token provider.** You pass the SDK a token provider that fetches the JWT-SVID from the SPIFFE Workload API, so you don’t need spiffe-helper. This needs a SPIFFE Workload API client library in your application’s language; Python and Go have mature ones. The Java SDK doesn’t accept a token provider, so in Java, use the file.
178
176179<Tabs>
177180 <Tab title="File-based with spiffe-helper">
178181 With spiffe-helper writing a fresh JWT-SVID to `/var/run/secrets/anthropic.com/token`, set `ANTHROPIC_IDENTITY_TOKEN_FILE` to that path. Also set the other federation environment variables that the following sample reads. The SDK reads the file on every token exchange, so it always picks up the most recently rotated SVID. It also refreshes the Anthropic access token automatically before it expires. See [Environment variables](https://platform.claude.com/docs/en/manage-claude/wif-reference#environment-variables) for where each value comes from.
from line 353
350353 </Tab>
351354
352355 <Tab title="Token provider through the SPIFFE Workload API">
353 Except in Java, workloads that link a SPIFFE Workload API client directly can skip spiffe-helper. They pass the SDK a token provider that fetches a fresh JWT-SVID from the agent socket. The SDK calls the provider before each token exchange, so the workload always presents an unexpired SVID. Python ([py-spiffe](https://github.com/HewlettPackard/py-spiffe)) and Go ([go-spiffe](https://github.com/spiffe/go-spiffe)) have mature Workload API clients.
356 Workloads that use a SPIFFE Workload API client library can skip spiffe-helper, in every SDK language except Java. They pass the SDK a token provider that fetches a fresh JWT-SVID from the agent socket. The SDK calls the provider before each token exchange, so the workload always presents an unexpired SVID. Python ([py-spiffe](https://github.com/HewlettPackard/py-spiffe)) and Go ([go-spiffe](https://github.com/spiffe/go-spiffe)) have mature Workload API clients.
354357
355358 <CodeGroup exclude="shell, typescript, java, csharp, php, ruby">
356359 ```python Python
No line in this hunk matches that.