JWT-to-RPST Token Exchange for Workload Identity Federation
- Services: IAM
- Release Date: August 26, 2026
IAM now supports exchanging JSON Web Tokens (JWTs) issued by trusted workload identity providers for Resource Principal Session Tokens (RPSTs) by using the Token Exchange grant type.
This flow enables workload identity federation for external workloads, such as GitHub Actions, Kubernetes workloads, and other OIDC-based workloads, allowing them to access OCI services as OCI resource principals without managing OCI users or long-lived API keys.
The JWT-to-RPST flow is available through the Token Exchange API and can be used with OCI SDKs, OCI CLI, and Terraform.
For more information, use the following links: