Introduction to the OIDC Identity Provider in Buddy

An OIDC identity provider in Buddy enables secure token exchange where claims are verified to issue short-lived API tokens. This eliminates storing permanent credentials while maintaining access control. GitHub Actions, CircleCI, and other tools supporting OIDC are included.

How OIDC works

1. Configure the OIDC identity provider in Security settings
2. External service passes its OIDC token to Buddy
3. Buddy verifies the token against trust conditions
4. Buddy generates a short-lived API token
5. The service uses the token to access the Buddy API

Accessing Identity Provider settings

1. Log in to your Buddy account
2. Go to Account → Security
3. Scroll to the OIDC IDENTITY PROVIDER section
4. Click the + button and select the provider type:
   • GitHub Actions - for GitHub Actions workflows
   • CircleCI - for CircleCI pipelines
   • Other provider - for generic OIDC providers

Image loading...

Image loading...

After creating an OIDC identity provider, you will receive a Provider ID (UUID format) used in external service configuration.

Provider-specific configuration

• GitHub Actions - OIDC configuration for GitHub Actions workflows
• CircleCI - OIDC configuration for CircleCI pipelines
• Other Provider - OIDC configuration for generic providers

Error handling

Token expiration – lifetime

If the set token lifetime expires, you will receive an error:

json
{
  "errors": [
    {
      "message": "Wrong authentication data"
    }
  ]
}

Perform another OIDC token → Buddy API token exchange or extend the token lifetime in provider configuration.

Missing required scope

If you try to call an API endpoint you don't have permissions for, you will receive an error:

json
{
  "errors": [
    {
      "message": "Insufficient scopes. Your token has the following scopes: [...]. This request requires the following scopes: <SCOPE_NAME>"
    }
  ]
}

Edit the OIDC identity provider and add the missing scope (indicated in the error) in the Scopes section.

Additional resources

• Trust Conditions - Learn how to configure trust conditions
• Supported scopes - Available permissions and scopes