ezgh auth oidc-exchange --org <org> --bot <bot> [--token-file f | --token-env VAR] [--audience a] [--expires-in d] [--name n] [flags]Exchange an OpenID Connect ID token (from GitHub Actions, GitLab CI or any identity provider the organization registered) for an API key that acts as a bot, when the bot’s OIDC trust matches the token. The key is printed alone on stdout (with -o json, { apiKey, token }), valid for --expires-in (15m to 12h, default 1h). No credential is needed: the token is the credential.
export EZGH_API_KEY=$(ezgh auth oidc-exchange --org acme --bot deployer)The token comes from --token-file (- for stdin) or --token-env, or, in a GitHub Actions job with permissions: id-token: write, from GitHub itself, for --audience (default: the profile’s domain, ezghcloud.com). --org and --bot are IDs or slugs (org_…, bot_…): names can’t be looked up without a credential.
Set it up first, with a login: register the provider (ezgh iam oidc-providers create) and add the bot’s OIDC trust (ezgh iam bots oidc-trust add).
Part of ezgh auth.
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--audience |
string | in GitHub Actions, the audience to ask GitHub for (default: the profile’s domain) | |
--bot |
string | the bot to act as, by ID or slug (required) | |
--expires-in |
duration | how long the key is valid, 15m to 12h (default 1h) | |
--name |
string | the key’s name (default: “OIDC: <the token’s sub>”) | |
--token-env |
string | read the ID token from this environment variable (GitLab CI’s id_tokens) | |
--token-file |
string | read the ID token from this file, or - for stdin |
This command also takes the global flags.