What are OpenID Connect (OIDC) tokens in GitHub Actions and how do they replace long-lived cloud credentials?

GitHub Actions can obtain a short-lived OpenID Connect (OIDC) JWT token for each workflow run. Cloud providers (AWS, Azure, GCP) can be configured to accept this token as proof of identity and issue temporary cloud credentials in exchange — eliminating the need to store long-lived API keys or access tokens in GitHub Secrets.

The token contains verifiable claims about the workflow run: repository name, branch, actor, environment, and the workflow ref. The cloud provider's trust policy checks these claims before granting access, so you can limit access to, for example, only the production environment on the main branch.

AWS example using aws-actions/configure-aws-credentials:

permissions:
  id-token: write    # required to request the OIDC token
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials via OIDC
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/GithubActionsDeployRole
          aws-region: us-east-1
          # No AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY needed

      - name: Deploy to S3
        run: aws s3 sync dist/ s3://my-bucket/

The AWS IAM role's trust policy specifies which GitHub repository and conditions it trusts:

{
  "Condition": {
    "StringEquals": {
      "token.actions.githubusercontent.com:sub":
        "repo:my-org/my-repo:environment:production"
    }
  }
}

Benefits over static credentials:

• No secret rotation needed — credentials expire automatically (typically 1 hour)
• No secret stored in GitHub — nothing to leak in logs or accidental commits
• Fine-grained trust — limit which repo, branch, or environment can assume the role