Login providers
Login providers issue short-lived credentials for downstream services. You invoke most of them through fn::open::<name>-login in an environment definition, and they return credentials that other providers and your own code can consume. The oidc provider instead returns a raw OpenID Connect (OIDC) token for an audience you choose, and debug-oidc-claims previews a token’s claims without signing one.
OIDC is the recommended authentication mode wherever supported. See Configuring OIDC for per-provider setup.
| Provider | Description |
|---|---|
| aws-login | Log in to AWS using OIDC or static credentials. |
| azure-login | Log in to Azure using OIDC or static credentials. |
| debug-oidc-claims | Preview the claims of an OIDC token without signing one. |
| doppler-login | Log in to Doppler using OIDC. |
| gcp-login | Log in to Google Cloud using OIDC or static credentials. |
| gh-login | Log in to GitHub using app credentials. |
| infisical-login | Log in to Infisical using OIDC or static credentials. |
| oidc | Mint an OIDC token for an audience you choose. |
| snowflake-login | Authenticate to Snowflake using OIDC. |
| vault-login | Log in to HashiCorp Vault using OIDC or static credentials. |