---
title: "ezgh auth oidc-exchange"
description: "Exchange a workload's OIDC ID token for a short-lived API key acting as a bot."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ezgh auth oidc-exchange

{/* Generated by ezgh-cli's internal/tools/clidocs from the ezgh command tree. Don't edit: change the command's help in ezgh-cli and regenerate. */}

```sh
ezgh auth oidc-exchange --org <org> --bot <bot> [--token-file f | --token-env VAR] [--audience a] [--expires-in d] [--name n] [flags]
```

Exchange an OpenID Connect ID token (from GitHub Actions, GitLab CI or any identity provider the organization registered) for an API key that acts as a bot, when the bot's OIDC trust matches the token. The key is printed alone on stdout (with -o json, &#123; apiKey, token &#125;), valid for `--expires-in` (15m to 12h, default 1h). No credential is needed: the token is the credential.

```text
export EZGH_API_KEY=$(ezgh auth oidc-exchange --org acme --bot deployer)
```

The token comes from `--token-file` (- for stdin) or `--token-env`, or, in a GitHub Actions job with `permissions: id-token: write`, from GitHub itself, for `--audience` (default: the profile's domain, ezghcloud.com). `--org` and `--bot` are IDs or slugs (org\_…, bot\_…): names can't be looked up without a credential.

Set it up first, with a login: register the provider (`ezgh iam oidc-providers create`) and add the bot's OIDC trust (`ezgh iam bots oidc-trust add`).

Part of [`ezgh auth`](/cli/reference/auth).

## Flags

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--audience` | string |  | in GitHub Actions, the audience to ask GitHub for (default: the profile's domain) |
| `--bot` | string |  | the bot to act as, by ID or slug (required) |
| `--expires-in` | duration |  | how long the key is valid, 15m to 12h (default 1h) |
| `--name` | string |  | the key's name (default: "OIDC: &lt;the token's sub&gt;") |
| `--token-env` | string |  | read the ID token from this environment variable (GitLab CI's id_tokens) |
| `--token-file` | string |  | read the ID token from this file, or - for stdin |

This command also takes the [global flags](/cli/reference#global-flags).

Source: https://docs.ezghcloud.com/cli/reference/auth-oidc-exchange/index.mdx