Skip to main content
This guide walks through the C1 federation wizard to create a provider and trust. Before starting, you need a service principal — if you don’t have one yet, follow Step 1 of the client credentials quick start. You don’t need to create a credential; federation replaces credentials with OIDC tokens.

​
Create a federation trust

1
Navigate to Directory > Service principals and select your service principal.
2
On the service principal detail page, select the Federation tab.
3
Click Setup federation.
4
Next, choose a provider. Select an existing provider, or create a new one. C1 includes presets for common platforms:
5
Configure the trust. For every provider except Custom OIDC, the wizard collects structured fields (organization, repository, branch, environment, and so on) and generates a CEL expression based on your inputs. You can switch to manual mode to write your own CEL expression. Custom OIDC has no structured fields — you write the CEL expression directly.Optional. Add IP restrictions and scoped roles for additional security. See security controls for details.
6
Click Create trust to finish.
7
Copy the client ID — you’ll need it in your CI/CD configuration.

​
Test your token

Before deploying to production, test the federation trust to make sure your CEL expression matches the expected JWT claims.
1
Click the trust in the Federation tab to open its detail drawer, then click Test.
2
Paste a sample JWT from your CI/CD platform, or provide claims as JSON.
3
The test runner validates each step:

​
Platform-specific guides

Once your trust is created, follow the integration guide for your CI/CD platform:
  • GitHub Actions — recommended for GitHub-based workflows
  • GitLab CI — uses GitLab’s built-in id_tokens
  • HCP Terraform — auto-detected from workspace identity tokens
  • AWS IAM — outbound identity federation from any AWS workload
  • SPIFFE — SPIFFE/SPIRE workload identities via JWT-SVID
  • Custom OIDC — any platform with OIDC support