Identity Providers - TrueFoundry Docs

Identity Providers let TrueFoundry trust JWTs issued by systems you already operate — corporate IdPs such as Okta and Entra, or workload platforms such as Kubernetes, GitHub Actions, AWS, and GCP. After validation, TrueFoundry resolves the token to a user, team, Virtual Account, or Agent and applies RBAC. Identity Providers are for API and gateway authentication. They do not replace SSO for UI login or SCIM for user lifecycle sync.

Choose a path

External JWT

Okta, Entra, Auth0, or a custom OIDC IdP. Send the IdP JWT as Authorization: Bearer on every call.

Workload Identity Federation

Kubernetes, GitHub Actions, AWS, or GCP. Exchange the platform JWT for a short-lived TrueFoundry token.

	External JWT	Workload Identity Federation
Typical issuers	Okta, Entra, Auth0, custom OIDC	Kubernetes, GitHub, AWS, GCP
Runtime	Send the IdP JWT as Bearer on every call	Exchange the platform JWT for a short-lived TrueFoundry token; re-exchange before expiry
IdP form	Issuer, audiences, JWKS, Resolve Token To	Issuer, audiences, JWKS, token TTL — no Resolve Token To
Mapping	Single claim value on VA, team, or Agent	VA: Claims map · Agent: Subject map
Principals	User, team, Virtual Account, Agent	Virtual Account or Agent (not teams)

Where to configure

Go to Settings > Security & Access > Identity Providers and add a provider. Use the External JWT form for corporate IdPs, or pick Kubernetes, GitHub, AWS, or GCP for workload federation.

Identity Providers section in TrueFoundry Security and Access settings — Identity Providers section in Security & Access settings

External JWT — field reference, Resolve Token To, gateway examples
Workload Identity Federation — exchange API and provider guides
Virtual Account mappings
SSO & SCIM — interactive login and user provisioning

​Choose a path

External JWT

Workload Identity Federation

​Where to configure

​Related

Choose a path

Where to configure

Related