Skip to main content
POST
Create a trusted workload policy
Requires keys:write on a management key or OAuth token, or a workspace owner or admin. Trusted workloads is in beta; workspaces without it get 404.
See Trusted Workloads for how policies work and how to manage them with Terraform.

Authorizations

Authorization
string
header
required

Bearer token authentication

Body

application/json
name
string
required
Required string length: 1 - 100
provider
enum<string>
required

The platform that issues the OIDC tokens.

Available options:
vercel,
github_actions
owner_id
string
required

The Vercel team ID or GitHub organisation or user ID to pin.

Minimum string length: 1
issuer
string

Required for Vercel: https://oidc.vercel.com/ followed by the team slug, or https://oidc.vercel.com for the global issuer. Defaults to https://token.actions.githubusercontent.com for GitHub Actions.

claim_conditions
object

Extra claims the token must match, as claim name to allowed values, for example project_id and environment for Vercel, or repository_id and ref for GitHub Actions. Every claim must match one of its values. At most 15 claims and 20 values per claim; iss, aud, exp, iat, nbf and jti cannot be used, and the pinned owner claim is set with owner_id.

max_token_lifetime_seconds
integer
default:43200

Longest token lifetime (exp minus iat or nbf) the policy accepts.

Required range: 60 <= x <= 43200

Response

Trusted workload policy created

data
object
required

A trusted workload: tokens from this issuer, for the pinned owner and matching every claim condition, authenticate as the policy's key.

Last modified on October 29, 2026