Overview
With OpenID Connect (OIDC), trusted issuers can create signed, short-lived JSON Web Tokens (JWTs) with a verified set of claims to define the context of a workflow (such as a GitHub repository ID and the ref it runs on). Organization admins can configure a trust policy with the expected set of claims and permissions to grant workflows. Workflows can then exchange that OIDC token with the PlanetScale API for a short-lived service token, replacing the need for long-lived credentials.Create an OIDC trust using the PlanetScale dashboard
To create an OIDC trust using the dashboard, log into your organization, go to the “Settings” > “OpenID Connect” page, and click the “New policy” button. Choose a policy name, an identity provider, a service token lifetime, the required claims, and the permissions to grant to the short-lived service tokens minted for this policy. Additional claims are recommended to scope a policy to a specific workflow, environment, or branch depending on the scenario.Providers
PlanetScale supports configuring OIDC with GitHub Actions and Depot CI. Refer to their respective documentation for information on the claims they support.Exchanging an OIDC token
A workflow in GitHub Actions or Depot CI with theid-token: write permission can request an OIDC token.
Use the planetscale/auth-action action in a Depot CI or GitHub Actions workflow job with the id-token: write permission to request
an OIDC token from the provider and exchange it for a service token:
planetscale/auth-action is a useful reference if you want to implement the exchange in your own tooling.