OIDC onhttps://chainguard-docs-preview-git-fork-eslerm-eslerm-custom-id-f0ac5e.chainguard.app/tags/oidc/Recent content in OIDC onHugo -- gohugo.ioen-USCopyright (c) 2023 ChainguardFri, 02 Oct 2026 13:51:55 +0000Set up and use Octo STShttps://chainguard-docs-preview-git-fork-eslerm-eslerm-custom-id-f0ac5e.chainguard.app/open-source/octo-sts/set-up-octo-sts/Fri, 02 Oct 2026 13:51:55 +0000https://chainguard-docs-preview-git-fork-eslerm-eslerm-custom-id-f0ac5e.chainguard.app/open-source/octo-sts/set-up-octo-sts/<p>Octo STS is a GitHub App that exchanges OIDC tokens from your workloads for short-lived GitHub tokens, so your automation doesn&rsquo;t need personal access tokens (PATs). This page shows you how to install Octo STS, write trust policies, exchange tokens, and fix failed exchanges. For background on why Octo STS exists, read <a href="https://www.chainguard.dev/supply-chain-security-101/octo-sts-overview">Octo STS: Short-lived GitHub tokens without PATs</a> in Supply Chain Security 101.</p> <h2 id="how-the-token-exchange-works" class="heading-2" data-heading-level="2"> <span class="heading-text">How the token exchange works</span> <a href="#how-the-token-exchange-works" class="anchor" aria-label="Link to How the token exchange works" title="Link to this section"> <svg width="16" height="9" viewBox="0 0 16 9" fill="none" xmlns="http://www.w3.org/2000/svg" aria-hidden="true"> <path d="M6.833 8.125H4C3 8.125 2.146 7.77067 1.438 7.062C0.729333 6.354 0.375 5.5 0.375 4.5C0.375 3.5 0.729333 2.646 1.438 1.938C2.146 1.22933 3 0.875 4 0.875H6.833V1.958H4C3.30533 1.958 2.708 2.208 2.208 2.708C1.708 3.208 1.458 3.80533 1.458 4.5C1.458 5.19467 1.708 5.792 2.208 6.292C2.708 6.792 3.30533 7.042 4 7.042H6.833V8.125ZM5.208 5.042V3.958H10.792V5.042H5.208ZM9.167 8.125V7.042H12C12.6947 7.042 13.292 6.792 13.792 6.292C14.292 5.792 14.542 5.19467 14.542 4.5C14.542 3.80533 14.292 3.208 13.792 2.708C13.292 2.208 12.6947 1.958 12 1.958H9.167V0.875H12C13 0.875 13.854 1.22933 14.562 1.938C15.2707 2.646 15.625 3.5 15.625 4.5C15.625 5.5 15.2707 6.354 14.562 7.062C13.854 7.77067 13 8.125 12 8.125H9.167Z" fill="currentColor"/> </svg> </a> </h2><p>Octo STS issues tokens according to trust policies that you keep in your repositories:</p>