What
Full Workload Identity Federation (WIF) authentication system enabling Claude Code to authenticate via OIDC identity tokens exchanged for access tokens, designed for enterprise CI/CD pipelines and service accounts.
Usage
# Via environment variables
export ANTHROPIC_FEDERATION_RULE_ID="your-rule-id"
export ANTHROPIC_ORGANIZATION_ID="your-org-id"
export ANTHROPIC_IDENTITY_TOKEN_FILE="/path/to/token"
claude
# Via profile config file (~/.config/anthropic/configs/<profile>.json)
{
"organization_id": "org-id",
"authentication": {
"type": "oidc_federation",
"federation_rule_id": "rule-id",
"identity_token": { "source": "file", "path": "/path/to/token" }
}
}Details
- Supports two authentication types:
oidc_federation(token exchange) anduser_oauth(file-based OAuth with refresh tokens) - Profile-based configuration via
ANTHROPIC_CONFIG_DIRandANTHROPIC_PROFILEenvironment variables - Credential file caching with automatic refresh and file permission safety checks (rejects world-readable/writable credentials)
- WIF status appears in
/statusoutput showing connection method (env-quadorcredentials-file) - Token manager with background refresh, expiration detection, and circuit-breaking on repeated failures
- Also supports
ANTHROPIC_SERVICE_ACCOUNT_IDandANTHROPIC_SCOPEfor advanced configurations
Evidence
OIDC provider (search for "oidc_federation") — oZq() at line ~109279, sZq() at line ~109337, env vars at line ~42691
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agree
/config search now matches option values (e.g. searching "vim" finds the Editor mode setting)