Stop storing PyPI API tokens in CI: use trusted publishing with OIDC
Long-lived PyPI tokens in CI are a standing risk. Trusted publishing uses OIDC claims to grant short-lived upload rights without storing secrets.
Loading…
ReadMeFeed / Community knowledge
#oidc
Real questions. Useful conversations. Find the people who know your stack.
pypiArchitecting Token-less Package Deployment with PyPI Trusted Publishing
Learn how to eliminate long-lived secrets in PyPI deployments using Trusted Publishing. This guide covers the OIDC architecture, trust boundaries, and configuration for token-less uploads.
Eliminating PyPI API Tokens with Trusted Publishers
Stop storing long-lived API tokens in your CI/CD secrets. Learn how to use PyPI Trusted Publishers and OIDC to secure your package deployments via GitHub Actions.
Choosing an Authentication Method for Teleport: Local, OIDC, or SAML
Guide to choosing Teleport auth method: compare local, OIDC, SAML; show GitHub OIDC setup and verification steps.
Securing Web Apps with Okta: Moving from Implicit to Authorization Code Flow
Stop leaking tokens in your URLs. Learn how to implement the OIDC Authorization Code Flow with Okta to secure user identity and verify JWTs using discovery endpoints.
oktaUsing Google Cloud Pub/Sub Push Subscriptions with OIDC for Secure Webhook Delivery
Learn how to configure Google Cloud Pub/Sub push subscriptions with OIDC tokens so that external webhooks receive authenticated events without managing custom token services.
google401 Unauthorized on Kubeflow dashboard after OIDC token revocation
In a Kubeflow environment utilizing Istio for authentication, the auth-proxy validates OIDC tokens at the request level. While Kubernetes RBAC manages permissions based on OIDC groups, there is a discrepancy between the identity provider's state and the active Istio session. When a user is deactivated or their credentials are rotated in the OIDC provider, th
kubeflowWhich mechanism handles token expiration for static Kubernetes service account credentials in Argo CD?
Credential Lifecycle Management Argo CD implements least-privilege access by mapping external identity provider groups to internal roles via RBAC policies. For OIDC-based authentication, the API server validates the exp claim on every request, resulting in an HTTP 401 response once the token expires, which necessitates a client-side re-authentication flow. S
argocdRestricted Contexts versus OIDC Tokens for Secure Integration Testing in CircleCI
Goal Run integration tests in CircleCI without exposing production credentials to the test job. Constraint Restricted contexts limit secret injection to matching branches but keep long‑lived secrets stored in CircleCI and are unavailable on forked pull‑request builds; OIDC tokens provide short‑lived cloud credentials without storing keys in CircleCI, yet req
circleci