Managed Auth with OpenID Connect

AWS setup

1. Add Render as an AWS Identity Provider

1. From your IAM Dashboard in the AWS Management Console, navigate to Identity Providers.

2. Add a new provider with the following settings:

   Provider Type	OpenID Connect
   Provider URL	oidc.render.com/{WORKSPACE_ID} Replace {WORKSPACE_ID} with your workspace's ID, available from the top of its Settings page in the Render Dashboard (starts with tea-).
   Audience	sts.amazonaws.com

3. Click Add provider.

4. Copy the ARN for the newly created provider. You'll use this value when configuring trust relationships for AWS roles in the next step.

2. Associate AWS roles with Render's OIDC identity

Do the following for each AWS role you want to assign to your Render services:

1. From your IAM Dashboard in the AWS Management Console, navigate to Roles.

2. Create a new Custom trust policy role (or modify an existing one).

3. Under Trust Relationship, add the highlighted object to the Statement array, substituting your provider ARN and workspace ID where indicated:

After you've created and updated your roles, copy their ARN values. You'll use these values when assigning roles to individual Render services in the next section.

Scoping access to specific services

Optionally, you can add finer-grained validation on the OIDC subject by checking the oidc.render.com/{WORKSPACE_ID}:sub value, which has the following format:

You can include multiple wildcards in your validation string with a StringLike condition.

For details, see Scoping access.

3. Connect individual services

Do the following for each service you want to connect:

1. Add an environment variable named AWS_ROLE_ARN to your service. Set its value to the ARN of the role you want to assign to the service.
   • You can assign only one role per service.
2. Redeploy the service with the new environment variable.

During the deploy, Render detects the new environment variable and automatically sets an additional environment variable named AWS_WEB_IDENTITY_TOKEN_FILE to the file path of your service's OIDC credentials.

Do not manually set the AWS_WEB_IDENTITY_TOKEN_FILE environment variable.

If you do, it might not match the credentials Render automatically sets.

GCP setup

1. Add Render as a workload identity pool provider

1. In the Google Cloud console, select your project and enable the following APIs:

   • Identity and Access Management (IAM) API
   • Security Token Service API
   • IAM Service Account Credentials API (required for service account impersonation)

   Alternatively, run the following command with the gcloud CLI to enable these APIs:

2. From the Google Cloud console, navigate to IAM & Admin > Workload Identity Federation.

3. Create a new workload identity pool (or select an existing one).

4. Add a provider to the pool with the following settings:

   Provider type	OpenID Connect (OIDC)
   Issuer (URL)	https://oidc.render.com/{WORKSPACE_ID} Replace {WORKSPACE_ID} with your workspace's ID (starts with tea-), available from the top of its Settings page in the Render Dashboard.
   Audiences	Default audience
   Attribute mapping	google.subject = assertion.sub

   Alternatively, run the following command with the gcloud CLI to create the pool and provider:

   Replace {POOL_ID} and {PROVIDER_ID} with names of your choosing, and {WORKSPACE_ID} with your workspace's ID.

5. Optionally, add an attribute condition to restrict which Render services can authenticate to GCP. If you do not grant access to individual services in the next step, we recommend adding an attribute condition to allowlist specific services.

   An attribute condition is a CEL expression that matches against the OIDC subject (assertion.sub). For example, to allow only services in the evm-def456 environment:

   For details, see Scoping access.

6. In a following step, you'll need your provider's resource name, which uses the following format:

   • Your project number (not the project ID) is available from the Google console's IAM & Admin > Settings page.
   • Your pool ID and provider ID are available from your pool and provider pages, respectively.

   Alternatively, run the following command with the gcloud CLI to print the resource name:

   Replace {POOL_ID} and {PROVIDER_ID} with the names of your pool and provider.

2. Grant access to Google Cloud resources

Render services are represented by federated principals when they authenticate to GCP. Granting IAM roles to those principals lets your services access your Google Cloud resources.

To grant a role to a specific Render service, you'll use the following principal:

To grant a role to every identity in your pool, you'll use the following principal set instead:

This principal set grants access to every service in your workspace unless you added an attribute condition to allowlist specific services in the previous step.

Option A: Grant roles to a federated principal (recommended)

Most Google Cloud APIs support direct access from federated principals. To access these APIs, grant a role directly to the principal:

1. In the Google Cloud console, navigate to IAM & Admin > IAM.
   • To grant access to a single resource instead of the whole project, open that resource's permissions (for example, the Permissions tab of a Cloud Storage bucket).
2. Click Grant access.
3. Under New principals, paste the principal (or principal set) from above, replacing the placeholders with your own values.
4. Select the roles you want to grant, then click Save.

Alternatively, run the following command with the gcloud CLI to grant a role to the principal:

Option B: Grant roles to a service account

For Google Cloud APIs that don't support federated principals, have your Render service impersonate a service account and grant it the roles instead:

1. In the Google Cloud console, navigate to IAM & Admin > Service Accounts.
2. Select an existing service account, or create a new one.
3. Open the service account's Principals with access tab, then click Grant access.
4. Under New principals, paste the principal (or principal set) from above, replacing the placeholders with your own values.
5. Select the Workload Identity User role (roles/iam.workloadIdentityUser), then click Save.
6. Grant the service account the roles it needs, as described in Option A, using the service account's email address as the principal.

Alternatively, run the following command with the gcloud CLI to grant the Workload Identity User role:

3. Connect individual services

Set the following environment variables on each service you want to connect to GCP, then redeploy:

During the deploy, Render detects GCP_WORKLOAD_IDENTITY_PROVIDER and writes a credential configuration file for your service's OIDC token. Render then sets an additional environment variable, GOOGLE_APPLICATION_CREDENTIALS, to the path of the new file.

Do not manually set the GOOGLE_APPLICATION_CREDENTIALS environment variable.

If you do, it might not match the credentials Render automatically sets.

Google Cloud client libraries use GOOGLE_APPLICATION_CREDENTIALS automatically through Application Default Credentials:

The client libraries in the examples above request their OAuth scopes automatically.

If you use a general-purpose library (such as google-auth or google-api-python-client), you must also specify a scope when authenticating:

The cloud-platform scope grants access to all Google Cloud APIs.

To authenticate the gcloud CLI on a service (for example, over SSH), you can use the credential file Render created:

Anthropic setup

1. Create an Anthropic service account

1. In the Claude Console, open your organization's Service accounts page.
2. Create a new service account with the Developer role to use for your OIDC connection.

2. Add Render as an Anthropic Identity Provider

1. Still in the Claude Console, navigate to your organization's Workload identity federation page and select the Issuers tab.

2. Connect a new Custom OIDC provider with the following settings:

   Issuer URL	https://oidc.render.com/{WORKSPACE_ID} Replace {WORKSPACE_ID} with your workspace's ID (starts with tea-), available from the top of its Settings page in the Render Dashboard.
   JWKS source	OIDC Discovery

3. Create a federation rule

1. Still on the Workload identity federation page, switch to the Rules tab.

2. Create a new federation rule with the following settings:

   Subject pattern	This value specifies which services in your workspace can authenticate via this rule. Provide a value in the format described in Scoping access. For example: This example matches all services in the evm-def456 environment.
   Expected audience	api.anthropic.com
   Token lifetime	At least 30 minutes

4. Connect your Render service

Set the following environment variables on your service, then redeploy:

• ANTHROPIC_FEDERATION_RULE_ID - The ID of the federation rule you created in the previous step.
• ANTHROPIC_ORGANIZATION_ID - The ID of your Anthropic organization, which is available from the Anthropic Organization tab.
• ANTHROPIC_SERVICE_ACCOUNT_ID - The ID of the service account you connected earlier, which is available from the Anthropic Service account tab.
• ANTHROPIC_WORKSPACE_ID - The ID of your Anthropic workspace, which is available from the Anthropic Workspaces tab.

During the deploy, Render detects the ANTHROPIC_FEDERATION_RULE_ID environment variable and automatically sets an additional environment variable named ANTHROPIC_IDENTITY_TOKEN_FILE to the file path of your service's OIDC credentials.

Do not manually set the ANTHROPIC_IDENTITY_TOKEN_FILE environment variable.

If you do, it might not match the credentials Render automatically sets.

By reading the environment variables above, the Anthropic SDK can authenticate automatically:

5. Test your connection (optional)

To test your connection with Anthropic:

1. Navigate to the Test connection tab of the OIDC rule you set up earlier.
2. SSH into your service and run the provided test script, setting JWT=$(cat $ANTHROPIC_IDENTITY_TOKEN_FILE).

OpenAI setup

1. Add Render as an OpenAI Identity Provider

1. From your Organization settings, navigate to the Security section, then to the Workload Identity Provider tab.

2. Create a new identity provider with the following settings:

   OIDC Issuer URL	https://oidc.render.com/{WORKSPACE_ID} Replace {WORKSPACE_ID} with your workspace's ID (starts with tea-), available from the top of its Settings page in the Render Dashboard.
   Audience	api.openai.com

2. Create a service mapping

1. Select the newly created identity provider, then create a new mapping.

2. Set the following value:

   Variable	Description
   sub	This value specifies which services in your workspace can authenticate via this mapping. Provide a value in the format described in Scoping access. For example: This example matches all services in the evm-def456 environment.

3. Choose or create a service account for your Render service to use. You will need the User ID of this account later, so after creating the mapping visit the People tab, select the service account, and copy the User ID visible in the details panel.

3. Connect your Render service

1. Set the following environment variables on your service, then redeploy:

   • OPENAI_IDENTITY_PROVIDER_ID - The identity provider ID from your OpenAI setup.
   • OPENAI_SERVICE_ACCOUNT_ID - The ID of the service account from your OpenAI setup, available in the OpenAI People tab.

   During the deploy, Render detects the OPENAI_IDENTITY_PROVIDER_ID environment variable and automatically sets an additional environment variable named OPENAI_IDENTITY_TOKEN_FILE to the file path of your service's OIDC credentials.

   Do not manually set the OPENAI_IDENTITY_TOKEN_FILE environment variable.

   If you do, it might not match the credentials Render automatically sets.

2. Your code should read the token from this file path at runtime and use it to initialize the OpenAI client:

   TypeScriptTypeScript

   PythonPython