# OIDC support in nixbuild.net

DevFeed: [OIDC support in nixbuild.net](<https://devfeed.tech/articles/oidc-support-in-nixbuild-net-34143.md>)

Original publisher: [Read original article](<https://blog.nixbuild.net/posts/2025-09-01-oidc-support-in-nixbuild-net.html>)

Author: support@nixbuild.net

Published: 2025-09-01T00:00:00Z

Content type: tutorial

Language: en

Sources: [nixbuild.net blog](<https://devfeed.tech/sources/nixbuild-net-blog.md>)

Topics: [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [Nix](<https://devfeed.tech/topics/nix.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [oidc](<https://devfeed.tech/tags/oidc.md>)

## AI overview

This tutorial explains how nixbuild.net uses OpenID Connect and Biscuit policies to create authentication tokens that require an OIDC JWT from a specified identity provider. It demonstrates securing GitHub Actions workflows for Nix builds by creating a base token, deriving an attenuated token with OIDC conditions, and passing a GitHub-issued OIDC JWT to nixbuild.net.

## Source excerpt

nixbuild.net now supports OpenID Connect (OIDC)! This means that you can create auth tokens that are only usable if you also can provide an OIDC JWT signed by a specific identity provider. In practice, you can now configure your GitHub Actions workflow with a nixbuild.net auth token that can only be used from within GitHub's infrastructure. You can even lock it down to specific GitHub repositories. This is a great step forward in securing nixbuild.net's authentication and authorization. This new feature is not specific to GitHub, but can be used together with any OIDC provider. Additionally, it is implemented on top of the existing Biscuit support in nixbuild.net. This further validates the usefulness and flexibility that nixbuild.net's Biscuit policies provide. Read on to find out exactly how it all fits together! A Usage Example Let's illustrate how OIDC works in nixbuild.net by working our way through a complete usage example. The repository used in this example is available for inspection at GitHub. Our objective is to configure a GitHub Actions workflow that uses nixbuild.net to perform Nix builds. We want to make use of OIDC to secure the nixbuild.net authentication and avoid the impact a workflow auth token leak could have. We have three steps to go through: Create a new nixbuild.net auth token with the base permissions needed for our GitHub workflow. Derive a new token from the original one, with a Biscuit policy that takes the OIDC context into account. This process is called attenuation and is done offline from nixbuild.net, on your local computer. Arguably, the nixbuild.net UI could offer a way to attach a Biscuit policy directly during token creation, but there is no such functionality yet. Create a GitHub Actions workflow that requests an OIDC JWT from GitHub and passes it on to nixbuild.net. Step 1: Create a Base Token Create a new nixbuild.net auth token using the nixbuild.net admin shell or the web UI. This token defines the "upper limit" of what our