# OAuth App Based Workload Identity for Droplets

DevFeed: [OAuth App Based Workload Identity for Droplets](<https://devfeed.tech/articles/oauth-app-based-workload-identity-for-droplets-19924.md>)

Original publisher: [Read original article](<https://www.digitalocean.com/blog/oauth-app-workload-identity-droplets>)

Author: John Andersen

Published: 2025-10-22T18:51:32Z

Content type: tutorial

Language: en

Sources: [DigitalOcean](<https://devfeed.tech/sources/digitalocean.md>)

Topics: [OAuth](<https://devfeed.tech/topics/oauth.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [Digital Ocean](<https://devfeed.tech/topics/digital-ocean.md>), [API](<https://devfeed.tech/topics/api.md>), [Cryptography](<https://devfeed.tech/topics/cryptography.md>), [Security](<https://devfeed.tech/topics/security.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>)

Tags: [access-control](<https://devfeed.tech/tags/access-control.md>), [api](<https://devfeed.tech/tags/api.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [cryptography](<https://devfeed.tech/tags/cryptography.md>), [digitalocean](<https://devfeed.tech/tags/digitalocean.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [identity](<https://devfeed.tech/tags/identity.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [tokens](<https://devfeed.tech/tags/tokens.md>), [trust-security](<https://devfeed.tech/tags/trust-security.md>)

## AI overview

This article introduces workload identity federation and explains how to implement it with DigitalOcean's OAuth API. It describes using asymmetric cryptography and OpenID Connect tokens so Droplets and GitHub Actions workflows can authenticate and access DigitalOcean resources without static, long-lived credentials.

## Source excerpt

This post is the first entry in a three part series on workload identity federation: Part 1: Architecture (this post) Part 2: Deployment and Configuration Part 3: Usage from Droplets and GitHub Actions This entry will cover what workload identity federation is and how it can be implemented leveraging DigitalOcean's OAuth API. In the following entries in this series, we'll deploy an open source Proof of Concept (PoC), configure roles and policies for workload identity access control, spin up a Droplet, write a GitHub Actions workflow, and access databases and Spaces keys from them using their respective workload identity tokens. What is workload identity federation? Workload identity is used to reduce the amount of secrets involved in deploying and administrating software systems. Instead of authentication being done based on something a workload knows, for example passwords or API tokens, authentication is done based on what the workload is. The heart of workload identity federation is asymmetric cryptography. By leveraging public / private key pairs, tokens can be issued to workloads, such as Droplets, and used for authentication and authorization to APIs exposed by resource servers. Workload identity tokens are exchanged for domain specific access tokens, or grant access to resources directly. This series showcases how we can use DigitalOcean's OAuth API and fine grained permission scopes to implement and leverage workload identity federation using OpenID Connect (OIDC) protocol tokens. We'll enable secretless access to DigitalOcean hosted databases and Spaces buckets from Droplets and GitHub Actions workflows. Eliminating the need to provision static, long-lived credentials for databases and Spaces buckets for those environments. Workload identity RBAC Security properties Authentication based on what the workload is requires that the infrastructure orchestrating the workload be able to make verifiable claims about a workload's properties. To do this, the infrastr