Skip to main content

akuity_service-account_exchange-token

akuity service-account exchange-token​

Exchange an OIDC token for a service account credential

Synopsis​

Exchange a token issued by a trusted OIDC issuer for a short-lived Akuity credential of the service account bound to it. No prior login is needed.

The credential is printed to stdout. Export it as AKUITY_SERVICE_ACCOUNT_TOKEN and every other command authenticates with it.

akuity service-account exchange-token [flags]

Examples​

  # GitHub Actions: the runner's ID token, read from stdin
  export AKUITY_SERVICE_ACCOUNT_TOKEN=$(curl -sS -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
    "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=<default audience of the issuer>" | jq -r .value |
    akuity service-account exchange-token --organization-id <org> --service-account-id <account> --subject-token-file -)

  # Token already in a file
  akuity service-account exchange-token --organization-id <org> --service-account-id <account> --subject-token-file token.jwt

Options​

  -h, --help                        help for exchange-token
      --organization-id string      Akuity cloud organization ID
  -o, --output string               Output format. One of (json, yaml, wide) (default "wide")
      --service-account-id string   Service account ID
      --subject-token string        The OIDC token to exchange
      --subject-token-file string   File holding the OIDC token to exchange, or - for stdin

Options inherited from parent commands​

      --insecure-skip-tls-verify   If true, the server's certificate will not be checked for validity
      --no-color                   Disable colored output (default true)
      --server string              The server url of the Akuity cloud (default "https://akuity.cloud")

SEE ALSO​