50 pages for oidc.

SEP-2207: OIDC-Flavored Refresh Token Guidance Model Context Protocol · title seps/2207-oidc-refresh-token-guidance console Claude Developer Platform · in the page agents-and-tools/mcp-tunnels/console …tically. Requires permission to manage federation rules, a registered OIDC issuer, and a federation rule with the `workspace:manage_tunnels` scope. * **[Manual](https://platform.claude.com/docs/en/a… Edit docker-compose.yaml: increment the integer in the setup service's Claude Developer Platform · in the page agents-and-tools/mcp-tunnels/deploy-compose …With programmatic access"> This path requires the host to have an OIDC identity provider (such as a cloud VM metadata server or SPIFFE). If it doesn't, use the **Without programmatic access** tab… deploy-helm Claude Developer Platform · in the page agents-and-tools/mcp-tunnels/deploy-helm …en/manage-claude/wif-providers/kubernetes) to register your cluster's OIDC issuer and create a federation rule. The setup component runs under its own ServiceAccount in the release namespace; the exac… overview Claude Developer Platform · in the page agents-and-tools/mcp-tunnels/overview …tically. Requires permission to manage federation rules, a registered OIDC issuer, and a federation rule with the `workspace:manage_tunnels` scope. * **[Manual](https://platform.claude.com/docs/en/a… troubleshooting Claude Developer Platform · in the page agents-and-tools/mcp-tunnels/troubleshooting …se `setup` service) authenticates to the Tunnels API by exchanging an OIDC JWT through your federation rule. When the exchange fails, see [Troubleshoot a failed exchange](https://platform.claude.com/d… Admin Claude Developer Platform · in the page api/admin …ade the request. `null` if not grouping by service account or for non-OIDC-federation requests. - `service_tier: "batch" or "flex" or "flex_discount" or 3 more or null` Service tier us… Federation Issuers Claude Developer Platform · in the page api/admin/federation_issuers …Issuer **POST** `/v1/organizations/federation_issuers` Register an OIDC issuer that Anthropic will trust for workload identity federation in your organization. The `jwks` field controls how the is… Archive Federation Issuer Claude Developer Platform · in the page api/admin/federation_issuers/archive …beta. ## Returns - `FederationIssuer object` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` m… Create Federation Issuer Claude Developer Platform · in the page api/admin/federation_issuers/create …Issuer **POST** `/v1/organizations/federation_issuers` Register an OIDC issuer that Anthropic will trust for workload identity federation in your organization. The `jwks` field controls how the is… List Federation Issuers Claude Developer Platform · in the page api/admin/federation_issuers/list …verification. - `Discovery object` JWKS via the issuer's OIDC discovery document. - `type: "discovery"` - `ca_cert_pem: optional string or null` Optional custom CA… Get Federation Issuer Claude Developer Platform · in the page api/admin/federation_issuers/retrieve …beta. ## Returns - `FederationIssuer object` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` m… Update Federation Issuer Claude Developer Platform · in the page api/admin/federation_issuers/update …ithout a `discovery_base`, this is also the URL Anthropic fetches the OIDC discovery document and signing keys from, so changing it repoints the JWKS source. Changing the issuer URL to a well-known sh… Federation Rules Claude Developer Platform · in the page api/admin/federation_rules …- `FederationRule object` Authorization rule binding an external OIDC identity to Anthropic. Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to… Archive Federation Rule Claude Developer Platform · in the page api/admin/federation_rules/archive …- `FederationRule object` Authorization rule binding an external OIDC identity to Anthropic. Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to… Create Federation Rule Claude Developer Platform · in the page api/admin/federation_rules/create …- `FederationRule object` Authorization rule binding an external OIDC identity to Anthropic. Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to… Get Federation Rule Claude Developer Platform · in the page api/admin/federation_rules/retrieve …- `FederationRule object` Authorization rule binding an external OIDC identity to Anthropic. Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to… Update Federation Rule Claude Developer Platform · in the page api/admin/federation_rules/update …- `FederationRule object` Authorization rule binding an external OIDC identity to Anthropic. Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to… Usage Report Claude Developer Platform · in the page api/admin/usage_report …ade the request. `null` if not grouping by service account or for non-OIDC-federation requests. - `service_tier: "batch" or "flex" or "flex_discount" or 3 more or null` Service tier us… Get Messages Usage Report Claude Developer Platform · in the page api/admin/usage_report/retrieve_messages …ade the request. `null` if not grouping by service account or for non-OIDC-federation requests. - `service_tier: "batch" or "flex" or "flex_discount" or 3 more or null` Service tier us… Organization Claude Developer Platform · in the page api/beta/organization …th the Admin API](/docs/en/manage-claude/wif-admin-api). Register an OIDC issuer that Anthropic will trust for workload identity federation in your organization. The `jwks` field controls how the is… Federation Claude Developer Platform · in the page api/beta/organization/federation …th the Admin API](/docs/en/manage-claude/wif-admin-api). Register an OIDC issuer that Anthropic will trust for workload identity federation in your organization. The `jwks` field controls how the is… Issuers Claude Developer Platform · in the page api/beta/organization/federation/issuers …th the Admin API](/docs/en/manage-claude/wif-admin-api). Register an OIDC issuer that Anthropic will trust for workload identity federation in your organization. The `jwks` field controls how the is… Archive Federation Issuer Claude Developer Platform · in the page api/beta/organization/federation/issuers/archive …` ## Returns - `BetaFederationIssuer object` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` m… Create Federation Issuer Claude Developer Platform · in the page api/beta/organization/federation/issuers/create …th the Admin API](/docs/en/manage-claude/wif-admin-api). Register an OIDC issuer that Anthropic will trust for workload identity federation in your organization. The `jwks` field controls how the is… List Federation Issuers Claude Developer Platform · in the page api/beta/organization/federation/issuers/list …ation. - `BetaJWKSDiscovery object` JWKS via the issuer's OIDC discovery document. - `type: "discovery"` - `ca_cert_pem: optional string or null` Optional custom CA… Get Federation Issuer Claude Developer Platform · in the page api/beta/organization/federation/issuers/retrieve …` ## Returns - `BetaFederationIssuer object` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` m… Update Federation Issuer Claude Developer Platform · in the page api/beta/organization/federation/issuers/update …ithout a `discovery_base`, this is also the URL Anthropic fetches the OIDC discovery document and signing keys from, so changing it repoints the JWKS source. Changing the issuer URL to a well-known sh… Rules Claude Developer Platform · in the page api/beta/organization/federation/rules …`BetaFederationRule object` Authorization rule binding an external OIDC identity to Anthropic. Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to… Archive Federation Rule Claude Developer Platform · in the page api/beta/organization/federation/rules/archive …`BetaFederationRule object` Authorization rule binding an external OIDC identity to Anthropic. Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to… Create Federation Rule Claude Developer Platform · in the page api/beta/organization/federation/rules/create …`BetaFederationRule object` Authorization rule binding an external OIDC identity to Anthropic. Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to… Get Federation Rule Claude Developer Platform · in the page api/beta/organization/federation/rules/retrieve …`BetaFederationRule object` Authorization rule binding an external OIDC identity to Anthropic. Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to… Update Federation Rule Claude Developer Platform · in the page api/beta/organization/federation/rules/update …`BetaFederationRule object` Authorization rule binding an external OIDC identity to Anthropic. Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to… Compliance API Claude Developer Platform · in the page api/compliance …ication"` A federated workload identity attempted to exchange an OIDC token for Anthropic API credentials. - `"platform_federation_issuer_archived"` An OIDC federation issuer was archived… Activities Claude Developer Platform · in the page api/compliance/activities …ication"` A federated workload identity attempted to exchange an OIDC token for Anthropic API credentials. - `"platform_federation_issuer_archived"` An OIDC federation issuer was archived… Query compliance activities Claude Developer Platform · in the page api/compliance/activities/list …ication"` A federated workload identity attempted to exchange an OIDC token for Anthropic API credentials. - `"platform_federation_issuer_archived"` An OIDC federation issuer was archived… claude-in-amazon-bedrock Claude Developer Platform · in the page build-with-claude/claude-in-amazon-bedrock …r Claude models. The trust policy names your identity provider (SAML, OIDC, or AWS Identity Center). The permissions policy grants `bedrock-mantle:CreateInference` only on the allowed model ARNs. </… admin-api Claude Developer Platform · in the page manage-claude/admin-api …if-admin-api#service-accounts). ### Federation issuers Register the OIDC identity providers (`fdis_...`) whose tokens may assert workload identity for your organization. See [Manage WIF with the Adm… authentication Claude Developer Platform · in the page manage-claude/authentication …eady trust, such as AWS IAM, Google Cloud, or any standards-compliant OIDC issuer (such as GitHub Actions, Kubernetes service accounts, SPIFFE, Microsoft Entra ID, or Okta). The workload exchanges its… wif-admin-api Claude Developer Platform · in the page manage-claude/wif-admin-api …oad-identity-federation#federation-issuers) (`fdis_...`) registers an OIDC identity provider with your organization. The `jwks` field is a discriminated union that controls how Anthropic fetches the p… aws Claude Developer Platform · in the page manage-claude/wif-providers/aws …to the Claude API without static API keys by exchanging an AWS-signed OIDC identity token. The recommended path calls the AWS STS [`GetWebIdentityToken`](https://docs.aws.amazon.com/STS/latest/APIRefe… Create the app registration that represents the Claude API audience. Claude Developer Platform · in the page manage-claude/wif-providers/azure …older registrations that still emit v1.0 tokens.) Entra publishes an OIDC discovery document at the per-tenant issuer URL, so use discovery mode. Each Microsoft Entra tenant you federate needs its ow… gcp Claude Developer Platform · in the page manage-claude/wif-providers/gcp ….google.com`, and Anthropic can validate it directly through standard OIDC discovery, with no extra Google Cloud configuration required. This guide shows how to register the Google issuer with Anthro… github-actions Claude Developer Platform · in the page manage-claude/wif-providers/github-actions …eturned JSON Web Token (JWT) to a file: ```yaml - name: Fetch GitHub OIDC token run: | curl -sS -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \ "$ACTIONS_ID_TOKEN_REQUEST_URL… kubernetes Claude Developer Platform · in the page manage-claude/wif-providers/kubernetes …lusters (kubeadm, k3s, OpenShift, and on-premises distributions) sign OIDC JSON Web Tokens (JWTs) for every pod through [projected service account tokens](https://kubernetes.io/docs/tasks/configure-po… okta Claude Developer Platform · in the page manage-claude/wif-providers/okta …eration. --- Okta can act as a workload identity provider by issuing OIDC access tokens to a **service application** through the OAuth 2.0 `client_credentials` grant. Your workload authenticates to O… Replace NODE_UID with the node's UID: Claude Developer Platform · in the page manage-claude/wif-providers/spiffe …tities. Anthropic federates with any SPIFFE implementation that emits OIDC-compatible JWT-SVIDs. For a current list of implementations, see [Commercial software that implements SPIFFE](https://spiffe.… wif-reference Claude Developer Platform · in the page manage-claude/wif-reference …| | `assertion` | Yes | The OIDC JWT issued by your identity provider.… workload-identity-federation Claude Developer Platform · in the page manage-claude/workload-identity-federation …loads authenticate to the Claude API with short-lived OpenID Connect (OIDC) tokens instead of long-lived `sk-ant-...` API keys. The tokens come from an identity provider (IdP) you already operate: AWS… overview Claude Developer Platform · in the page release-notes/overview …ederation). Authenticate workloads to the Claude API with short-lived OIDC tokens from your own identity provider (AWS IAM, Google Cloud, GitHub Actions, Kubernetes, Microsoft Entra ID, Okta, SPIFFE,…