OIDC token debugger for CI trust policies

Paste the OIDC token your CI job received (or just its decoded payload) and this page names the platform, splits the sub claim into its parts, shows when the token was issued and expires, and tests your trust condition the way AWS and Microsoft Entra do. If the condition does not match, it points to the first character that differs and names the usual causes: letter case, a wildcard a standard Entra credential will not expand, and GitHub's new immutable sub format for repositories created after 15 July 2026. Everything runs in your browser. Nothing is uploaded, stored or logged, and the page never verifies signatures: it only decodes. Use a short-lived test token, not a production one.

This page reads GitHub Actions, GitLab CI/CD, Forgejo Actions (including Codeberg) and Buildkite subjects. For any other issuer it still decodes the token and compares your condition, but it will not split the subject. The CI OIDC Atlas ($12) covers 11 platforms with a vendor quote behind every cell, and its oidc-trust.mjs builds and tests conditions for all of them. The free 4-row sample CSV shows the columns.

Why a trust condition that looks right does not match

• The job names an environment. GitHub then puts environment:NAME in the subject instead of the branch, so a condition on ref:refs/heads/main never matches.
• Letter case. AWS string conditions and Entra both compare case sensitively. Microsoft enforced that first for apps and managed identities created after 14 August 2024, then for inactive ones from 27 September 2024; for active older ones it said the date would be announced.
• A new subject format. GitHub repositories created after 15 July 2026, or opted in, or renamed or transferred since then, use repo:OWNER@ID/REPO@ID. The likeliest breakage is an org-wide StringLike pattern such as repo:octo-org/*, which no longer matches repo:octo-org@123456/...; this page flags that case. Forgejo 16 writes numeric IDs into the subject for repositories that enabled Actions after that release.
• Wildcards where they are not supported. A standard Entra federated credential compares exactly (a flexible federated identity credential, in preview for GitHub, GitLab and Terraform Cloud, can match a pattern); StringEquals in AWS does not expand * or ? either.
• Merge request or fork pipelines. On GitLab, the path and ref claims in a merge request pipeline describe the source project and branch.

A decoded token is not a trusted token. Only your cloud provider, which checks the signature against the issuer's keys, can say a token is genuine.