Managed Auth with OpenID Connect

Connect Render services to popular providers using OIDC.

With a Pro workspace or higher, you can configure your Render services to authenticate with supported third-party providers using OpenID Connect (OIDC). Render manages a short-lived authentication token for each of your services that automatically rotates as needed.

Render currently supports managed OIDC for the following providers:

AWS
Anthropic
OpenAI

Setup

Only an admin for your organization's provider account can complete these steps.

Select the tab for your provider:

AWS setup

1. Add Render as an AWS Identity Provider

From your IAM Dashboard in the AWS Management Console, navigate to Identity Providers.

Add a new provider with the following settings:

Provider Type

OpenID Connect

Provider URL

oidc.render.com/{WORKSPACE_ID}

Replace {WORKSPACE_ID} with your workspace's ID, available from the top of its Settings page in the Render Dashboard (starts with tea-).

Audience

sts.amazonaws.com

Click Add provider.
Copy the ARN for the newly created provider. You'll use this value when configuring trust relationships for AWS roles in the next step.

2. Associate AWS roles with Render's OIDC identity

Do the following for each AWS role you want to assign to your Render services:

From your IAM Dashboard in the AWS Management Console, navigate to Roles.
Create a new Custom trust policy role (or modify an existing one).

Under Trust Relationship, add the highlighted object to the Statement array, substituting your provider ARN and workspace ID where indicated:

json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "{PROVIDER_ARN}"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "oidc.render.com/{WORKSPACE_ID}:aud": "sts.amazonaws.com"
                }
            }
        }
    ]
}

After you've created and updated your roles, copy their ARN values. You'll use these values when assigning roles to individual Render services in the next section.

Optionally, you can add finer-grained validation on the OIDC subject by checking the oidc.render.com/{WORKSPACE_ID}:sub value, which has the following format:

plaintext

workspace:{WORKSPACE_ID}:environment:{ENVIRONMENT_ID}:service:{SERVICE_ID}

You can include multiple wildcards in your validation string with a StringLike condition.

For details, see Scoping access.

3. Connect individual services

Do the following for each service you want to connect:

Add an environment variable named AWS_ROLE_ARN to your service. Set its value to the ARN of the role you want to assign to the service.
- You can assign only one role per service.
Redeploy the service with the new environment variable.

During the deploy, Render detects the new environment variable and automatically sets an additional environment variable named AWS_WEB_IDENTITY_TOKEN_FILE to the file path of your service's OIDC credentials.

Do not manually set the AWS_WEB_IDENTITY_TOKEN_FILE environment variable.

If you do, it might not match the credentials Render automatically sets.

Anthropic setup

1. Create an Anthropic service account

In the Claude Console, open your organization's Service accounts page.
Create a new service account with the Developer role to use for your OIDC connection.

2. Add Render as an Anthropic Identity Provider

Still in the Claude Console, navigate to your organization's Workload identity federation page and select the Issuers tab.

Connect a new Custom OIDC provider with the following settings:

Issuer URL

https://oidc.render.com/{WORKSPACE_ID}

Replace {WORKSPACE_ID} with your workspace's ID (starts with tea-), available from the top of its Settings page in the Render Dashboard.

JWKS source

OIDC Discovery

3. Create a federation rule

Still on the Workload identity federation page, switch to the Rules tab.

Create a new federation rule with the following settings:

Subject pattern

This value specifies which services in your workspace can authenticate via this rule. Provide a value in the format described in Scoping access.

For example:

plaintext

workspace:tea-abc123:environment:evm-def456:service:*

This example matches all services in the evm-def456 environment.

Expected audience

api.anthropic.com

Token lifetime

At least 30 minutes

4. Connect your Render service

Set the following environment variables on your service, then redeploy:

ANTHROPIC_FEDERATION_RULE_ID - The ID of the federation rule you created in the previous step.
ANTHROPIC_ORGANIZATION_ID - The ID of your Anthropic organization, which is available from the Anthropic Organization tab.
ANTHROPIC_SERVICE_ACCOUNT_ID - The ID of the service account you connected earlier, which is available from the Anthropic Service account tab.
ANTHROPIC_WORKSPACE_ID - The ID of your Anthropic workspace, which is available from the Anthropic Workspaces tab.

During the deploy, Render detects the ANTHROPIC_FEDERATION_RULE_ID environment variable and automatically sets an additional environment variable named ANTHROPIC_IDENTITY_TOKEN_FILE to the file path of your service's OIDC credentials.

Do not manually set the ANTHROPIC_IDENTITY_TOKEN_FILE environment variable.

If you do, it might not match the credentials Render automatically sets.

By reading the environment variables above, the Anthropic SDK can authenticate automatically:

index.ts

typescript

import Anthropic from '@anthropic-ai/sdk';

const client = new Anthropic();

const message = await client.messages.create({
    max_tokens: 1024,
    messages: [{ role: "user", content: "Hello, Claude" }],
    model: "claude-sonnet-5"
});

for (const block of message.content) {
    if (block.type === "text") {
        console.log(block.text);
    }
}

main.py

python

from anthropic import Anthropic

client = Anthropic()

message = client.messages.create(
    model="claude-sonnet-5",
    max_tokens=1024,
    messages=[{"role": "user", "content": "Hello, Claude"}],
)
print(message.content[0].text)

5. Test your connection (optional)

To test your connection with Anthropic:

Navigate to the Test connection tab of the OIDC rule you set up earlier.
SSH into your service and run the provided test script, setting JWT=$(cat $ANTHROPIC_IDENTITY_TOKEN_FILE).

OpenAI setup

1. Add Render as an OpenAI Identity Provider

From your Organization settings, navigate to the Security section, then to the Workload Identity Provider tab.

Create a new identity provider with the following settings:

OIDC Issuer URL

https://oidc.render.com/{WORKSPACE_ID}

Replace {WORKSPACE_ID} with your workspace's ID (starts with tea-), available from the top of its Settings page in the Render Dashboard.

Audience

api.openai.com

2. Create a service mapping

Select the newly created identity provider, then create a new mapping.

Set the following value:

Variable Description

Variable	Description
sub	This value specifies which services in your workspace can authenticate via this mapping. Provide a value in the format described in Scoping access. For example: plaintext workspace:tea-abc123:environment:evm-def456:service:* This example matches all services in the `evm-def456` environment.

sub

This value specifies which services in your workspace can authenticate via this mapping. Provide a value in the format described in Scoping access.

For example:

plaintext

workspace:tea-abc123:environment:evm-def456:service:*

This example matches all services in the evm-def456 environment.

Choose or create a service account for your Render service to use. You will need the User ID of this account later, so after creating the mapping visit the People tab, select the service account, and copy the User ID visible in the details panel.

3. Connect your Render service

Set the following environment variables on your service, then redeploy:
- OPENAI_IDENTITY_PROVIDER_ID - The identity provider ID from your OpenAI setup.
- OPENAI_SERVICE_ACCOUNT_ID - The ID of the service account from your OpenAI setup, available in the OpenAI People tab.
During the deploy, Render detects the OPENAI_IDENTITY_PROVIDER_ID environment variable and automatically sets an additional environment variable named OPENAI_IDENTITY_TOKEN_FILE to the file path of your service's OIDC credentials.

Do not manually set the OPENAI_IDENTITY_TOKEN_FILE environment variable.

If you do, it might not match the credentials Render automatically sets.

Your code should read the token from this file path at runtime and use it to initialize the OpenAI client:

index.ts

typescript

import { readFileSync } from "node:fs";
import OpenAI from "openai";

const tokenPath = process.env.OPENAI_IDENTITY_TOKEN_FILE!;

const client = new OpenAI({
  workloadIdentity: {
    identityProviderId: process.env.OPENAI_IDENTITY_PROVIDER_ID!,
    serviceAccountId: process.env.OPENAI_SERVICE_ACCOUNT_ID!,
    provider: {
      tokenType: "jwt",
      getToken: () => readFileSync(tokenPath, "utf8").trim(),
    },
  },
});

main.py

python

import os
from pathlib import Path

from openai import OpenAI

TOKEN_PATH = os.environ.get("OPENAI_IDENTITY_TOKEN_FILE")

client = OpenAI(
    workload_identity={
        "identity_provider_id": os.environ["OPENAI_IDENTITY_PROVIDER_ID"],
        "service_account_id": os.environ["OPENAI_SERVICE_ACCOUNT_ID"],
        "provider": {
            "token_type": "jwt",
            "get_token": Path(TOKEN_PATH).read_text().strip
        },
    },
)

Scoping access

Each Render service's OIDC token contains a subject (sub) claim that identifies exactly which service is requesting access. This claim's value always has the following format:

plaintext

workspace:{WORKSPACE_ID}:environment:{ENVIRONMENT_ID}:service:{SERVICE_ID}

Component Description

Component	Description
`{WORKSPACE_ID}`	Your Render workspace ID, which starts with `tea-`. You can find this value at the top of the workspace's Settings page in the Render Dashboard.
`{ENVIRONMENT_ID}`	An environment ID, which starts with `evm-`. You can find this value in the URL of the environment's Settings page in the Render Dashboard. For services that do not belong to an environment, this value is `default`.
`{SERVICE_ID}`	The service ID, which starts with `srv-`. You can find this value at the top of the service's Settings page in the Render Dashboard.

{WORKSPACE_ID}

Your Render workspace ID, which starts with tea-.

You can find this value at the top of the workspace's Settings page in the Render Dashboard.

{ENVIRONMENT_ID}

An environment ID, which starts with evm-.

You can find this value in the URL of the environment's Settings page in the Render Dashboard.

For services that do not belong to an environment, this value is default.

{SERVICE_ID}

The service ID, which starts with srv-.

You can find this value at the top of the service's Settings page in the Render Dashboard.

Use this value when configuring your provider’s access rules. You can use an exact subject to authorize a single service, or use wildcard matching where supported by your provider.

Here are some example validation strings compatible with all supported providers:

python

# Allow all services in workspace tea-abc123
workspace:tea-abc123:*

# Allow all services in environment evm-def456
workspace:tea-abc123:environment:evm-def456:*

# Only allow the single service srv-ghi789
workspace:tea-abc123:environment:evm-def456:service:srv-ghi789

Limitations

Currently, OIDC auth is not available at build time for services that build from a Dockerfile.
- OIDC is available at build time for services on any native runtime.
OIDC auth does not currently enable image-backed services to pull private images from AWS ECR.
- These services can pull private images from AWS ECR using a generated credential.

Troubleshooting

"No OpenIDConnect provider found in your account for https://oidc.render.com/WORKSPACE_ID"

The AWS identity provider configuration for Render was not set up correctly. Make sure that your Provider URL matches the URL in the error message.

Setup

AWS setup

1. Add Render as an AWS Identity Provider

2. Associate AWS roles with Render's OIDC identity

Scoping access to specific services

3. Connect individual services

Anthropic setup

1. Create an Anthropic service account

2. Add Render as an Anthropic Identity Provider

3. Create a federation rule

4. Connect your Render service

5. Test your connection (optional)

OpenAI setup

1. Add Render as an OpenAI Identity Provider

2. Create a service mapping

3. Connect your Render service

Scoping access

Limitations

Troubleshooting

"No OpenIDConnect provider found in your account for https://oidc.render.com/WORKSPACE_ID"

Managed Auth with OpenID Connect