# Managed Auth with OpenID Connect — Connect Render services to popular providers using OIDC.

With a *Pro* workspace or higher, you can configure your Render services to authenticate with supported third-party providers using OpenID Connect (OIDC). Render manages a short-lived authentication token for each of your services that automatically rotates as needed.

Render currently supports managed OIDC for the following providers:

- AWS
- Anthropic
- OpenAI

## Setup

> *Only an admin for your organization's provider account can complete these steps.*

Select the tab for your provider:

**Tab: AWS**

### AWS setup

#### 1. Add Render as an AWS Identity Provider

1. From your IAM Dashboard in the AWS Management Console, navigate to *Identity Providers*.
2. Add a new provider with the following settings:

|  |  |
| --- | --- |
| *Provider Type* | `OpenID Connect` |
| *Provider URL* | `oidc.render.com/{WORKSPACE_ID}` Replace `{WORKSPACE_ID}` with your workspace's ID, available from the top of its *Settings* page in the [Render Dashboard](https://dashboard.render.com) (starts with `tea-`). |
| *Audience* | `sts.amazonaws.com` |

3. Click *Add provider*.

4. Copy the *ARN* for the newly created provider. You'll use this value when configuring trust relationships for AWS roles in the next step.

#### 2. Associate AWS roles with Render's OIDC identity

Do the following for _each_ AWS role you want to assign to your Render services:

1. From your IAM Dashboard in the AWS Management Console, navigate to *Roles*.
2. Create a new *Custom trust policy role* (or modify an existing one).
3. Under *Trust Relationship*, add the highlighted object to the `Statement` array, *substituting your provider ARN and workspace ID where indicated*:

    ```json
    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Principal": {
                    "Federated": "{PROVIDER_ARN}"
                },
                "Action": "sts:AssumeRoleWithWebIdentity",
                "Condition": {
                    "StringEquals": {
                        "oidc.render.com/{WORKSPACE_ID}:aud": "sts.amazonaws.com"
                    }
                }
            }
        ]
    }
    ```

After you've created and updated your roles, copy their *ARN* values. You'll use these values when assigning roles to individual Render services in the next section.

##### Scoping access to specific services

Optionally, you can add finer-grained validation on the OIDC subject by checking the `oidc.render.com/{WORKSPACE_ID}:sub` value, which has the following format:

```
workspace:{WORKSPACE_ID}:environment:{ENVIRONMENT_ID}:service:{SERVICE_ID}
```

You can include multiple wildcards in your validation string with a `StringLike` condition.

For details, see [Scoping access](#scoping-access).

#### 3. Connect individual services

Do the following for _each_ service you want to connect:

1. Add an environment variable named `AWS_ROLE_ARN` to your service. Set its value to the *ARN* of the role you want to assign to the service.
    - You can assign only one role per service.
2. Redeploy the service with the new environment variable.

During the deploy, Render detects the new environment variable and automatically sets an _additional_ environment variable named `AWS_WEB_IDENTITY_TOKEN_FILE` to the file path of your service's OIDC credentials.

> *Do not manually set the `AWS_WEB_IDENTITY_TOKEN_FILE` environment variable.*
>
> If you do, it might not match the credentials Render automatically sets.

**Tab: Anthropic**

### Anthropic setup

#### 1. Create an Anthropic service account

1. In the Claude Console, open your organization's [Service accounts page](https://platform.claude.com/settings/service-accounts).
2. Create a new service account with the *Developer* role to use for your OIDC connection.

#### 2. Add Render as an Anthropic Identity Provider

1. Still in the Claude Console, navigate to your organization's [Workload identity federation page](https://platform.claude.com/settings/workload-identity-federation) and select the *Issuers* tab.

2. Connect a new Custom OIDC provider with the following settings:

|  |  |
| --- | --- |
| *Issuer URL* | `https://oidc.render.com/{WORKSPACE_ID}` Replace `{WORKSPACE_ID}` with your workspace's ID (starts with `tea-`), available from the top of its *Settings* page in the [Render Dashboard](https://dashboard.render.com). |
| *JWKS source* | OIDC Discovery |

#### 3. Create a federation rule

1. Still on the [Workload identity federation page](https://platform.claude.com/settings/workload-identity-federation), switch to the *Rules* tab.
2. Create a new federation rule with the following settings:

|  |  |
| --- | --- |
| *Subject pattern* | This value specifies _which_ services in your workspace can authenticate via this rule. Provide a value in the format described in [Scoping access](#scoping-access). For example: ```
    workspace:tea-abc123:environment:evm-def456:service:*
    ``` This example matches all services in the `evm-def456` environment. |
| *Expected audience* | `api.anthropic.com` |
| *Token lifetime* | At least 30 minutes |

#### 4. Connect your Render service

Set the following environment variables on your service, then redeploy:

- `ANTHROPIC_FEDERATION_RULE_ID` - The ID of the federation rule you created in the previous step.
- `ANTHROPIC_ORGANIZATION_ID` - The ID of your Anthropic organization, which is available from the [Anthropic Organization tab](https://platform.claude.com/settings/organization).
- `ANTHROPIC_SERVICE_ACCOUNT_ID` - The ID of the service account you connected earlier, which is available from the [Anthropic Service account tab](https://platform.claude.com/settings/service-accounts).
- `ANTHROPIC_WORKSPACE_ID` - The ID of your Anthropic workspace, which is available from the [Anthropic Workspaces tab](https://platform.claude.com/settings/workspaces).

During the deploy, Render detects the `ANTHROPIC_FEDERATION_RULE_ID` environment variable and automatically sets an _additional_ environment variable named `ANTHROPIC_IDENTITY_TOKEN_FILE` to the file path of your service's OIDC credentials.

> *Do not manually set the `ANTHROPIC_IDENTITY_TOKEN_FILE` environment variable.*
>
> If you do, it might not match the credentials Render automatically sets.

By reading the environment variables above, the Anthropic SDK can authenticate automatically:

**Subtab: TypeScript**

```typescript
import Anthropic from '@anthropic-ai/sdk';

const client = new Anthropic();

const message = await client.messages.create({
    max_tokens: 1024,
    messages: [{ role: "user", content: "Hello, Claude" }],
    model: "claude-sonnet-5"
});

for (const block of message.content) {
    if (block.type === "text") {
        console.log(block.text);
    }
}
```

**Subtab: Python**

```python
from anthropic import Anthropic

client = Anthropic()

message = client.messages.create(
    model="claude-sonnet-5",
    max_tokens=1024,
    messages=[{"role": "user", "content": "Hello, Claude"}],
)
print(message.content[0].text)
```

#### 5. Test your connection (optional)

To test your connection with Anthropic:

1. Navigate to the *Test connection* tab of the OIDC rule you set up earlier.
2. [SSH into your service](ssh) and run the provided test script, setting `JWT=$(cat $ANTHROPIC_IDENTITY_TOKEN_FILE)`.

**Tab: OpenAI**

### OpenAI setup

#### 1. Add Render as an OpenAI Identity Provider

1. From your [Organization settings](https://platform.openai.com/settings/organization/security/workload-identity-provider), navigate to the *Security* section, then to the *Workload Identity Provider* tab.
2. Create a new identity provider with the following settings:

|  |  |
| --- | --- |
| *OIDC Issuer URL* | `https://oidc.render.com/{WORKSPACE_ID}` Replace `{WORKSPACE_ID}` with your workspace's ID (starts with `tea-`), available from the top of its *Settings* page in the [Render Dashboard](https://dashboard.render.com). |
| *Audience* | `api.openai.com` |

#### 2. Create a service mapping

1. Select the newly created identity provider, then create a new mapping.
2. Set the following value:

------

##### sub

This value specifies _which_ services in your workspace can authenticate via this mapping. Provide a value in the format described in [Scoping access](#scoping-access).

    For example:

    ```
    workspace:tea-abc123:environment:evm-def456:service:*
    ```

    This example matches all services in the `evm-def456` environment.

------

3. Choose or create a service account for your Render service to use. You will need the User ID of this account later, so after creating the mapping visit the [People tab](https://platform.openai.com/settings/organization/people/members), select the service account, and copy the User ID visible in the details panel.

#### 3. Connect your Render service

1. Set the following environment variables on your service, then redeploy:

    - `OPENAI_IDENTITY_PROVIDER_ID` - The identity provider ID from your OpenAI setup.
    - `OPENAI_SERVICE_ACCOUNT_ID` - The ID of the service account from your OpenAI setup, available in the [OpenAI People tab](https://platform.openai.com/settings/organization/people/members).

    During the deploy, Render detects the `OPENAI_IDENTITY_PROVIDER_ID` environment variable and automatically sets an _additional_ environment variable named `OPENAI_IDENTITY_TOKEN_FILE` to the file path of your service's OIDC credentials.

> *Do not manually set the `OPENAI_IDENTITY_TOKEN_FILE` environment variable.*
>
>     If you do, it might not match the credentials Render automatically sets.

2. Your code should read the token from this file path at runtime and use it to initialize the OpenAI client:

    **Subtab: TypeScript**

    ```typescript
    import { readFileSync } from "node:fs";
    import OpenAI from "openai";

    const tokenPath = process.env.OPENAI_IDENTITY_TOKEN_FILE!;

    const client = new OpenAI({
      workloadIdentity: {
        identityProviderId: process.env.OPENAI_IDENTITY_PROVIDER_ID!,
        serviceAccountId: process.env.OPENAI_SERVICE_ACCOUNT_ID!,
        provider: {
          tokenType: "jwt",
          getToken: () => readFileSync(tokenPath, "utf8").trim(),
        },
      },
    });
    ```

    **Subtab: Python**

    ```python
    import os
    from pathlib import Path

    from openai import OpenAI

    TOKEN_PATH = os.environ.get("OPENAI_IDENTITY_TOKEN_FILE")

    client = OpenAI(
        workload_identity={
            "identity_provider_id": os.environ["OPENAI_IDENTITY_PROVIDER_ID"],
            "service_account_id": os.environ["OPENAI_SERVICE_ACCOUNT_ID"],
            "provider": {
                "token_type": "jwt",
                "get_token": Path(TOKEN_PATH).read_text().strip
            },
        },
    )
    ```

## Scoping access

Each Render service's OIDC token contains a subject (`sub`) claim that identifies exactly which service is requesting access. This claim's value always has the following format:

```
workspace:{WORKSPACE_ID}:environment:{ENVIRONMENT_ID}:service:{SERVICE_ID}
```

| Component | Description |
| --- | --- |
| `{WORKSPACE_ID}` | Your Render workspace ID, which starts with `tea-`. You can find this value at the top of the workspace's *Settings* page in the [Render Dashboard](https://dashboard.render.com). |
| `{ENVIRONMENT_ID}` | An environment ID, which starts with `evm-`. You can find this value in the URL of the environment's *Settings* page in the [Render Dashboard](https://dashboard.render.com). For services that do not belong to an environment, this value is `default`. |
| `{SERVICE_ID}` | The service ID, which starts with `srv-`. You can find this value at the top of the service's *Settings* page in the [Render Dashboard](https://dashboard.render.com). |

Use this value when configuring your provider’s access rules. You can use an exact subject to authorize a single service, or use wildcard matching where supported by your provider.

Here are some example validation strings compatible with all supported providers:

```python
# Allow all services in workspace tea-abc123
workspace:tea-abc123:*

# Allow all services in environment evm-def456
workspace:tea-abc123:environment:evm-def456:*

# Only allow the single service srv-ghi789
workspace:tea-abc123:environment:evm-def456:service:srv-ghi789
```

## Limitations

- Currently, OIDC auth is not available at build time for services that build [from a Dockerfile](docker#building-from-a-dockerfile).
  - OIDC _is_ available at build time for services on any [native runtime](native-runtimes).
- OIDC auth does not currently enable [image-backed services](/deploying-an-image) to pull private images from AWS ECR.
  - These services _can_ pull private images from AWS ECR using a [generated credential](/deploying-an-image#credentials-for-private-images).

## Troubleshooting

###### "No OpenIDConnect provider found in your account for https://oidc.render.com/WORKSPACE_ID"

The AWS identity provider configuration for Render was not set up correctly. Make sure that your *Provider URL* matches the URL in the error message.


---

##### Appendix: Glossary definitions

###### environment variable

Config values you can apply to a service to customize its behavior at build and runtime, such as `NODE_VERSION` or `OPENAI_API_KEY`.

Render sets some environment variables for your service by [default](environment-variables).

Related article: https://render.com/docs/configure-environment-variables.md