---
title: "ezgh iam bots oidc-trust add"
description: "Let workloads whose OIDC tokens match act as a bot."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ezgh iam bots oidc-trust add

{/* Generated by ezgh-cli's internal/tools/clidocs from the ezgh command tree. Don't edit: change the command's help in ezgh-cli and regenerate. */}

```sh
ezgh iam bots oidc-trust add <bot> --provider <p> --subject <pattern> [--claim name=value …] [flags]
```

Let workloads holding an ID token from `--provider` exchange it for the bot's API keys, when the token's sub matches `--subject` (\* is any run of characters) and each `--claim` equals the token's claim exactly. Prefer claims that survive renames, like GitHub's repository_id and repository_owner_id. For GitHub Actions the subject must start with repo:&lt;owner&gt;/ unless a claim pins repository_owner_id or repository_id: repo:\* would trust every repository on GitHub.

GitHub sends sub as repo:&lt;owner&gt;/&lt;repo&gt;:&lt;context&gt; or, with IDs, as repo:&lt;owner&gt;@&lt;owner id&gt;/&lt;repo&gt;@&lt;repo id&gt;:&lt;context&gt; (GitHub decides which). repo:\*:&lt;context&gt; with the repository's ID pinned fits both; get the ID with gh api repos/&lt;owner&gt;/&lt;repo&gt; `--jq` .id. When an exchange is refused, ezgh auth oidc-exchange prints the token's sub to compare.

```text
ezgh iam bots oidc-trust add deployer --provider github --subject 'repo:*:ref:refs/heads/main' --claim repository_id=804930151
ezgh iam bots oidc-trust add deployer --provider github --subject 'repo:*:environment:production' --claim repository_id=804930151
ezgh iam bots oidc-trust add deployer --provider github --subject 'repo:*' --claim repository_owner_id=1342004
ezgh iam bots oidc-trust add deployer --provider github --subject 'repo:acme/app:ref:refs/heads/main'
ezgh iam bots oidc-trust add deployer --provider gitlab --subject 'project_path:acme/app:ref_type:branch:ref:main'
```

Part of [`ezgh iam bots oidc-trust`](/cli/reference/iam-bots-oidc-trust).

## Flags

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--claim` | string, repeatable |  | name=value: a claim the token must have, exactly (repeat for more, at most 10) |
| `--provider` | string |  | the OIDC provider, by ID, slug, name or issuer (required) |
| `--subject` | string |  | the pattern the token's sub must match; \* is any run of characters (required) |

This command also takes the [global flags](/cli/reference#global-flags).

Source: https://docs.ezghcloud.com/cli/reference/iam-bots-oidc-trust-add/index.mdx