> ## Documentation Index
> Fetch the complete documentation index at: https://www.truefoundry.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity Providers

> Choose how external JWTs authenticate to TrueFoundry: direct Bearer (External JWT) or token exchange (Workload Identity Federation).

Identity Providers let TrueFoundry trust JWTs issued by systems you already operate — corporate IdPs such as Okta and Entra, or workload platforms such as Kubernetes, GitHub Actions, AWS, and GCP. After validation, TrueFoundry resolves the token to a user, team, Virtual Account, or Agent and applies RBAC.

Identity Providers are for **API and gateway authentication**. They do not replace [SSO](https://www.truefoundry.com/docs/platform/sso/overview.md) for UI login or SCIM for user lifecycle sync.

## Choose a path

> [card] [External JWT](https://www.truefoundry.com/docs/platform/identity-providers/external-jwt.md)
>
> Okta, Entra, Auth0, or a custom OIDC IdP. Send the IdP JWT as `Authorization: Bearer` on every call.

> [card] [Workload Identity Federation](https://www.truefoundry.com/docs/platform/identity-providers/workload-identity-federation/overview.md)
>
> Kubernetes, GitHub Actions, AWS, or GCP. Exchange the platform JWT for a short-lived TrueFoundry token.

| | [External JWT](https://www.truefoundry.com/docs/platform/identity-providers/external-jwt.md) | [Workload Identity Federation](https://www.truefoundry.com/docs/platform/identity-providers/workload-identity-federation/overview.md) |
| - | - | - |
| Typical issuers | Okta, Entra, Auth0, custom OIDC | Kubernetes, GitHub, AWS, GCP |
| Runtime | Send the IdP JWT as Bearer on every call | Exchange the platform JWT for a short-lived TrueFoundry token; re-exchange before expiry |
| IdP form | Issuer, audiences, JWKS, **Resolve Token To** | Issuer, audiences, JWKS, token TTL — no Resolve Token To |
| Mapping | Single claim **value** on VA, team, or Agent | VA: **Claims** map · Agent: **Subject** map |
| Principals | User, team, Virtual Account, Agent | Virtual Account or Agent (not teams) |

## Where to configure

Go to **Settings > Security & Access > Identity Providers** and add a provider. Use the External JWT form for corporate IdPs, or pick **Kubernetes**, **GitHub**, **AWS**, or **GCP** for workload federation.

![Identity Providers section in TrueFoundry Security and Access settings](https://mintcdn.com/truefoundry/xnxwG9wbAPzCd_DD/images/docs/platform/security-access-identity-providers.png?fit=max\&auto=format\&n=xnxwG9wbAPzCd_DD\&q=85\&s=0e862ee64317b5cce9307757f408dd16)

Identity Providers section in Security & Access settings

## Related

* [External JWT](https://www.truefoundry.com/docs/platform/identity-providers/external-jwt.md) — field reference, Resolve Token To, gateway examples
* [Workload Identity Federation](https://www.truefoundry.com/docs/platform/identity-providers/workload-identity-federation/overview.md) — exchange API and provider guides
* [Virtual Account mappings](https://www.truefoundry.com/docs/platform/virtual-account-management.md#identity-provider-mappings)
* [SSO & SCIM](https://www.truefoundry.com/docs/platform/sso/overview.md) — interactive login and user provisioning


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.