{"version":"2.1.116","anchor":"oidc-federation-authentication","canonical_anchor":"oidc-federation-authentication","heading":"OIDC Federation Authentication","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.116\/e\/oidc-federation-authentication","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.116","markdown":"### OIDC Federation Authentication\n\n**What**\n\nFull Workload Identity Federation (WIF) authentication system enabling Claude Code to authenticate via OIDC identity tokens exchanged for access tokens, designed for enterprise CI\/CD pipelines and service accounts.\n\n**Usage**\n\n`# Via environment variables export ANTHROPIC_FEDERATION_RULE_ID=\"your-rule-id\" export ANTHROPIC_ORGANIZATION_ID=\"your-org-id\" export ANTHROPIC_IDENTITY_TOKEN_FILE=\"\/path\/to\/token\" claude # Via profile config file (~\/.config\/anthropic\/configs\/<profile>.json) { \"organization_id\": \"org-id\", \"authentication\": { \"type\": \"oidc_federation\", \"federation_rule_id\": \"rule-id\", \"identity_token\": { \"source\": \"file\", \"path\": \"\/path\/to\/token\" } } }` **Details** - Supports two authentication types: `oidc_federation` (token exchange) and `user_oauth` (file-based OAuth with refresh tokens) - Profile-based configuration via `ANTHROPIC_CONFIG_DIR` and `ANTHROPIC_PROFILE` environment variables - Credential file caching with automatic refresh and file permission safety checks (rejects world-readable\/writable credentials) - WIF status appears in `\/status` output showing connection method (`env-quad` or `credentials-file`) - Token manager with background refresh, expiration detection, and circuit-breaking on repeated failures - Also supports `ANTHROPIC_SERVICE_ACCOUNT_ID` and `ANTHROPIC_SCOPE` for advanced configurations **Evidence** OIDC provider (search for `\"oidc_federation\"`) \u2014 `oZq()` at line ~109279, `sZq()` at line ~109337, env vars at line ~42691"}