Grant `id-token: write` when using cloud federation.
Section: OIDC and fork safety
Enable OIDC token issuance
yaml
yaml
permissions:
id-token: write
contents: readExplanation
OIDC lets workflows exchange a short-lived identity token for cloud credentials without storing static secrets.
Learn the surrounding workflow
Compare similar commands or jump into common fixes when this command is part of a bigger troubleshooting path.
Related commands
Same sheet · prioritizing OIDC and fork safety
Configure AWS credentials via OIDC
Use the AWS credentials action without long-lived keys.
Authenticate to Google Cloud with OIDC
Use workload identity federation for GCP.
Do not expose secrets to untrusted forks
Avoid unsafe patterns for public repo pull requests.
Set least-privilege token permissions
Limit the default GITHUB_TOKEN scope.
Grant write access only where needed
Elevate token permissions on a specific job.