---
title: "ezgh iam oidc-providers create"
description: "Register an OIDC identity provider whose ID tokens bots may trust."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ezgh iam oidc-providers create

{/* Generated by ezgh-cli's internal/tools/clidocs from the ezgh command tree. Don't edit: change the command's help in ezgh-cli and regenerate. */}

```sh
ezgh iam oidc-providers create <name> --issuer <url> [--audiences a,…] [flags]
```

Register an OpenID Connect identity provider. Workloads holding its ID tokens can exchange them for API keys of bots whose OIDC trust matches (`ezgh iam bots oidc-trust add`). The issuer is compared with tokens' iss exactly and can't change; EZGH Cloud reads its discovery document now, and its keys on every exchange.

`--audiences` are the aud values accepted (default: the profile's domain, which `ezgh auth oidc-exchange` asks GitHub for). For GitHub Actions:

```text
ezgh iam oidc-providers create github --issuer https://token.actions.githubusercontent.com
```

Part of [`ezgh iam oidc-providers`](/cli/reference/iam-oidc-providers).

## Flags

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--audiences` | strings, comma-separated or repeated |  | the audiences accepted, 1 to 10 (default: the profile's domain) |
| `--issuer` | string |  | the issuer URL, exactly as tokens' iss says it (required) |

This command also takes the [global flags](/cli/reference#global-flags).

Source: https://docs.ezghcloud.com/cli/reference/iam-oidc-providers-create/index.mdx