Managed Auth with OpenID Connect

1. Add Render as an AWS Identity Provider

1. From your IAM Dashboard in the AWS Management Console, navigate to Identity Providers.

2. Add a new provider with the following settings:

   Provider Type	OpenID Connect
   Provider URL	oidc.render.com/{YOUR_WORKSPACE_ID} Replace {YOUR_WORKSPACE_ID} with your workspace's ID, available from the top of its Settings page in the Render Dashboard (starts with tea-).
   Audience	sts.amazonaws.com

3. Click Add provider.

4. Copy the ARN for the newly created provider. You'll use this value when configuring trust relationships for AWS roles in the next step.

2. Associate AWS roles with Render's OIDC identity

Do the following for each AWS role you want to assign to your Render services:

1. From your IAM Dashboard in the AWS Management Console, navigate to Roles.

2. Create a new Custom trust policy role (or modify an existing one).

3. Under Trust Relationship, add the highlighted object to the Statement array, substituting your provider ARN and workspace ID where indicated:

4. Optionally, you can add finer-grained validation on the OIDC subject by checking the oidc.render.com/{WORKSPACE_ID}:sub value, which has the following format:

   • To obtain an environment's ID, open its Settings page in the Render Dashboard and copy its ID from the URL. This value starts with evm-.
   • For services that don't belong to any environment, the value of ENVIRONMENT_ID is default.

   Here are some example Conditions that you can use to limit the role to specific services:

After you've created and updated your roles, copy their ARN values. You'll use these values when assigning roles to individual Render services in the next section.

3. Connect individual services

Do the following for each service you want to connect:

1. Add an environment variable named AWS_ROLE_ARN to your service. Set its value to the ARN of the role you want to assign to the service.
   • You can assign only one role per service.
2. Redeploy the service with the new environment variable.

During the deploy, Render detects the new environment variable and automatically sets an additional environment variable named AWS_WEB_IDENTITY_TOKEN_FILE to the file path of your service's OIDC credentials.

Do not manually set the AWS_WEB_IDENTITY_TOKEN_FILE environment variable.

If you do, it might not match the credentials Render automatically sets.

1. Add Render as an Anthropic Identity Provider

1. From the Claude Console organization settings, navigate to the Workload Identity section, then to the Issuers tab.

2. Connect a new Custom OIDC provider with the following settings:

   Issuer URL	https://oidc.render.com/{YOUR_WORKSPACE_ID} Replace {YOUR_WORKSPACE_ID} with your workspace's ID (starts with tea-), available from the top of its Settings page in the Render Dashboard.
   JWKS source	OIDC Discovery

2. Create a federation rule

• To obtain an environment's ID, open its Settings page in the Render Dashboard and copy its ID from the URL. This value starts with evm-.
• For services that don't belong to any environment, the value of ENVIRONMENT_ID is default.

3. Connect or create a service account

Create or connect an Anthropic service account to complete the OIDC setup.

After configuring an Anthropic service account, the setup is complete and you can close the Connect workload panel. Continuing the setup enables you to test the OIDC connection; you can perform this test after connecting your Render service in the next step.

4. Connect your Render service

Set the following environment variables on your service, then redeploy.

When Render detects the ANTHROPIC_FEDERATION_RULE_ID variable, it automatically sets ANTHROPIC_IDENTITY_TOKEN_FILE to the file path of your service's OIDC token. Your code should read the token from this file path at runtime.

Do not manually set the ANTHROPIC_IDENTITY_TOKEN_FILE environment variable.

If you do, it might not match the credentials Render automatically sets.

By setting each of the environment variables above, the Anthropic SDK will authenticate automatically:

5. Test your connection (optional)

To test your connection with Anthropic:

1. Navigate to the Test connection tab of the OIDC rule you set up earlier.
2. SSH into your service and run the provided test script, setting JWT=$(cat $ANTHROPIC_IDENTITY_TOKEN_FILE).

1. Add Render as an OpenAI Identity Provider

1. From your Organization settings, navigate to the Security section, then to the Workload Identity Provider tab.

2. Create a new identity provider with the following settings:

   OIDC Issuer URL	https://oidc.render.com/{YOUR_WORKSPACE_ID} Replace {YOUR_WORKSPACE_ID} with your workspace's ID (starts with tea-), available from the top of its Settings page in the Render Dashboard.
   Audience	api.openai.com

2. Create a service mapping

1. Select the identity provider you just created, then create a new mapping.

2. To limit this connection to a single Render service, set the following values:

   Variable	Description
   sub	workspace:{WORKSPACE_ID}:environment:{ENVIRONMENT_ID}:service:{SERVICE_ID}

   • To obtain an environment's ID, open its Settings page in the Render Dashboard and copy its ID from the URL. This value starts with evm-.
   • For services that don't belong to any environment, the value of ENVIRONMENT_ID is default.

3. Choose or create a service account for your Render service to use. You will need the User ID of this account later, so after creating the mapping visit the People tab, select the service account, and copy the User ID visible in the details panel.

3. Connect your Render service

1. Set the following environment variables on your service, then redeploy:

   Variable	Description
   OPENAI_IDENTITY_PROVIDER_ID	The identity provider ID from your OpenAI setup
   OPENAI_SERVICE_ACCOUNT_ID	The ID of the service account from your OpenAI setup, available in the OpenAI People tab

   When Render detects the OPENAI_IDENTITY_PROVIDER_ID variable, it automatically sets an additional environment variable named OPENAI_IDENTITY_TOKEN_FILE to the file path of your service's OIDC token.

   Do not manually set the OPENAI_IDENTITY_TOKEN_FILE environment variable.

   If you do, it might not match the credentials Render automatically sets.

2. Your code should read the token from this file path at runtime and use it to initialize the OpenAI client:

   TypeScriptTypeScript

   PythonPython