> ## Documentation Index
> Fetch the complete documentation index at: https://trigger.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Custom OIDC integrations

> Connect tasks to services without an official Trigger.dev OIDC integration.

Use `auth.getOIDCToken()` with a service that accepts external OIDC identities for workload authentication. You configure trust in that service and implement its authentication flow.

Support for OIDC user login does not necessarily mean a service accepts workload identities. Check the service's federation documentation before starting.

## Configure trust

Follow the [OIDC prerequisites](https://trigger.dev/docs/oidc.md#prerequisites), then go to the [OIDC](https://cloud.trigger.dev/_/oidc) page for your environment and copy the issuer URL and subject.

In the receiving service:

1. Register your organization's issuer, `https://oidc.trigger.dev/YOUR_ORG_SLUG`, using its [discovery endpoint](https://trigger.dev/docs/oidc.md#how-tokens-work) or signing keys as required.
2. Configure the expected audience. Use the service's required value, or choose one if it allows you to.
3. Restrict access to the exact environment subject, directly or through the service's identity-mapping rules.
4. Grant the identity only the permissions your task needs.

The service must verify the signature, issuer, audience, and expiry, and enforce the subject restriction. Trusting the issuer and audience alone does not isolate access to one environment.

## Request a token

Request a token inside your task with the exact audience configured in the receiving service:

```typescript theme={"theme":"css-variables"}
import { auth, task } from "@trigger.dev/sdk";

export const federatedTask = task({
  id: "federated-task",
  run: async () => {
    const { token } = await auth.getOIDCToken({
      audience: "https://service.example.com",
    });

    // Use the service's documented token exchange or authentication flow here.
    // Never log or return the token.
  },
});
```

`auth.getOIDCToken({ audience })` returns `Promise<{ token: string; expiresAt: Date }>`.

Most services exchange the token for service-specific credentials. Follow their documentation for the endpoint, request format, and credential refresh behavior. Send the OIDC token directly as a bearer token only if the service explicitly supports that flow.

Keep tokens and credentials within the executing run and refresh before expiry. Redeploy with the updated CLI and SDK, then start a new run. For local Development runs, use the service's own development credentials instead.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.