Prebuilt modules for authenticating Replit development sandboxes to external services using workload identity federation (WIF) and OpenID Connect (OIDC).
These modules are for development sandboxes only. They do not provide authentication for published apps, including Autoscale, Reserved VM, and Scheduled Deployments.
| Module | What it does |
|---|---|
aws-oidc |
Sets up the AWS CLI and SDKs with short-lived AWS credentials |
gcp-oidc |
Sets up gcloud and the Google Cloud SDKs with short-lived Google Cloud credentials |
azure-oidc |
Sets up the Azure CLI and SDKs with short-lived Microsoft Entra credentials |
vault-oidc |
Sets up the HashiCorp Vault CLI with short-lived Vault tokens |
infisical-oidc |
Sets up the Infisical CLI with short-lived Infisical access tokens |
jfrog-oidc |
Sets up the JFrog CLI with short-lived JFrog access tokens |
Each module's README covers its usage and options.
Replit development sandboxes support workload identity federation. Replit is an OpenID Connect (OIDC) identity provider, so external services can trust tokens issued to a development sandbox without requiring long-lived credentials.
This authentication setup does not carry over when you publish an app. Configure the published app's authentication separately using production app secrets.
Mint a short-lived token for an audience:
replit identityv2 create --audience <audience>
Tokens are issued by https://sts.replit.com. Services discover it at
https://sts.replit.com/.well-known/openid-configuration and verify
signatures against https://sts.replit.com/.well-known/jwks.json.
Every token carries at least these claims:
{
"iss": "https://sts.replit.com",
"sub": "//replit.com/customer/<customer-id>/org/<org-id>/<kind>/<sandbox-id>",
"aud": "<audience>",
"exp": 1767225900,
"jti": "00000000-0000-0000-0000-000000000000",
"kind": "<kind>",
"customer_id": "<customer-id>",
"org_id": "<org-id>",
"sandbox_id": "<sandbox-id>",
"resource_group_id": "<resource-group-id>",
...
}The sub prefix //replit.com/customer/<customer-id>/org/<org-id>/ is the
same for every token in an organization; the rest identifies the workload that
minted it, and varies by kind. Additional claims depend on the kind of
workload. Bind trust to org_id (or the sub prefix), not to the full
subject.
To see your own values, decode a token's body:
replit identityv2 create --audience TEST \ | cut -d. -f2 | tr '_-' '/+' | base64 -d 2>/dev/null | python3 -m json.tool
Report vulnerabilities as described in SECURITY.md.
MIT. See LICENSE.