Plainwork / Catalogue / CI OIDC Atlas
How 11 CI platforms issue OIDC tokens, quoted from source
Issuer, audience, subject format, token lifetime and gotchas for 11 CI and deploy platforms, a quote from the vendor page behind every cell, plus the AWS, Entra and GCP rules and a tested Node trust-condition builder.
- 11 platforms as CSV and JSON: GitHub Actions, GitLab, CircleCI, Bitbucket, Buildkite, HCP Terraform, Forgejo, Vercel, Semaphore, Octopus, Spacelift
- Per platform: issuer, default audience, default and customisable sub, token lifetime, how to request it, gotcha, docs link (24 columns)
- 151 verbatim vendor quotes: a script re-checks each against a saved copy of the page, and 16 cells say "Not stated" instead of guessing
- 248 claim rows: the claims each vendor's cited pages list, and for 10 platforms (204 rows) whether the issuer's live claims_supported advertises them too
- 13 consumer-side rules for AWS, Microsoft Entra, Google Cloud, npm, PyPI and RubyGems
- oidc-trust.mjs: split, build and test subjects and generate AWS, Entra and GCP configuration, with 35 tests; plus an offline viewer
| Platform | Default sub | Token lifetime | Gotcha |
|---|---|---|---|
| Bitbucket Pipelines | {REPOSITORY_UUID}[:{ENVIRONMENT_UUID}]:{STEP_UUID} (the braces are part of each UUID; the environment part… | Not stated on the cited pages | The last part of the sub is the step UUID, so a condition that must match across builds has to wildcard it (Atlassian's own examples use StringLike… |
| CircleCI | $CIRCLE_OIDC_TOKEN: org/<organization_id>/project/<project-id>/user/<user_id> | One hour after issuance | The sub contains the UUID of the CircleCI user who triggered the job, so pin the project with the oidc.circleci.com/project-id claim (an AWS… |
| Vercel | owner:[TEAM_SLUG]:project:[PROJECT_NAME]:environment:[ENVIRONMENT] (environment is development, preview,… | Build tokens one hour; function tokens for preview and… | Renaming the team or project changes the claims (sub contains the team slug and project name, aud the team slug), so existing trust policies stop… |
| HCP Terraform / Terraform Enterprise | organization:ORG:project:PROJECT:workspace:WORKSPACE:run_phase:PHASE (project name is Default Project unless… | Workspace runs: expires at the end of the plan or apply… | The sub contains the project and workspace names, and the docs say names can be changed; the id claims (terraform_workspace_id,… |
Each full row also has the issuer, audience, variants, request method and the quotes. Example of a quote, Bitbucket's sub format: {REPOSITORY_UUID}[:{ENVIRONMENT_UUID}]:{STEP_UUID} (the braces are part of each UUID;…. Download the free 4-row sample CSV (GitHub Actions, GitLab, Forgejo, Buildkite, all columns).
Made for
Who it's for
Every cell has its source
Each fact carries a verbatim quote from the vendor's page, and a script fails the build if a quote is not found in the saved page. Unknowns say "Not stated on the cited pages".
Docs against the live issuer
We fetched all 11 public discovery documents on 13 Oct 2026 and show which claims the docs list and the issuer does not, and the reverse, such as Bitbucket's deploymentEnvironment. Octopus's docs show an issuer with a trailing slash; its live one has none.
Both sides of the trust
The cloud side is covered too: AWS StringEquals and StringLike semantics, Entra's exact-match and case-sensitive rules and its flexible-credential preview, the 20-credential and 600-character limits, Google Cloud's attribute limit and which CIs npm accepts.
A builder that agrees with the docs
oidc-trust.mjs has tests built from each vendor's documented examples, including the full example token Atlassian prints. Its builders reject missing or bad parts with a plain error, never a half-built subject, and it never claims a token is verified.
What's inside
Everything you get
How it works
From checkout to done
Buy
Pay securely with Stripe.
Open
Your download page opens straight away.
Use
Download everything and start using it. Bookmark the page to come back.
Questions
Good to know
What is free?
The token debugger (with copy-ready AWS, Entra and Google Cloud snippets), a 4-row sample CSV (GitHub Actions, GitLab, Forgejo, Buildkite, all columns) and an MIT library with parsers and builders for those four platforms plus trustCondition, inspect and the matchers, which work for any sub. Paid: the full dataset and quotes for all 11 platforms, the claims comparison, consumer rules, offline viewer and the other seven platforms' parsers. GitHub and GitLab are free, so if that is all you use, the free tools may be enough.
How do I know the cells are right?
Each non-empty cell has a verbatim quote from the vendor page, and the build script checks every quote against a saved copy of that page. Cells the cited pages do not state say so. Pages change, so every row has the date it was read; re-read a page before relying on it in production.
Was it tested against real tokens?
The library is tested against each vendor's documented examples and the full example token Atlassian prints in its docs. We did not mint live tokens on every platform, and the README says so. It decodes tokens and never verifies signatures.
Which platforms are covered?
11: GitHub Actions, GitLab CI/CD, CircleCI, Bitbucket Pipelines, Buildkite, HCP Terraform, Forgejo Actions (including Codeberg), Vercel, Semaphore, Octopus Deploy and Spacelift. Azure Pipelines and Jenkins are not in this version.
Does it replace the vendor docs?
No. It puts the facts you compare most next to each other with their sources, so you read one table instead of eleven sites. The quotes link back to the pages.
What if it doesn't work for me?
If it doesn't work as described or you can't access it, email us within 14 days and we'll fix it or refund you. See the refund policy for details.
CI OIDC Atlas
11 CI platforms' OIDC token formats, quoted from vendor pages and live discovery documents, with a tested trust-condition builder.
More from the catalogue
Other small tools
Switch Brief
A sourced replacement brief for the dev tool you want to leave: your must-haves as tests, dated prices and licences, in 24 hours.
Causeway
Free daily bridges puzzle: one answer each, solvable by logic, no ads, no account. Supporter Pass $4.
Turnkeep
Fair on-call and duty rota planner with swaps and a fairness table. Free for 4 people, $6/month flat for a team.