id

id is a Python tool for generating OIDC identities. It can automatically detect and produce OIDC credentials on an number of environments, including GitHub Actions and Google Cloud.

Installation

id requires Python 3.7 or newer, and can be installed directly via pip:

python -m pip install id

Usage

You can run id as a Python module via python -m:

python -m id --help

Top-level:

usage: id [-h] [-V] [-v] audience

a tool for generating OIDC identities

positional arguments:
  audience       the OIDC audience to use

optional arguments:
  -h, --help     show this help message and exit
  -V, --version  show program's version number and exit
  -v, --verbose  run with additional debug logging; supply multiple times to
                 increase verbosity (default: 0)

For Python API usage, there is a single importable function, detect_credential:

>>> from id import detect_credential
>>> detect_credential(audience='something')
'<OIDC token>'

This function requires an audience parameter, which is used when generating the OIDC token. This should be set to the intended audience for the token.

Supported environments

id currently supports ambient credential detection in the following environments:

• GitHub Actions
• Google Cloud
  • Cloud Run
  • Google Kubernetes Engine
  • Compute Engine
  • and more
• Buildkite

Licensing

id is licensed under the Apache 2.0 License.

Contributing

See the contributing docs for details.

SLSA Provenance

This project emits a SLSA provenance on its release! This enables you to verify the integrity of the downloaded artifacts and ensured that the binary's code really comes from this source code.

To do so, please follow the instructions here.