On Runtime, every sandbox can get an OpenID Connect token that names the sandbox, its organization and its image. The token is free and needs no API key. Your AWS or Google Cloud account trusts Runtime once. A sandbox then assumes a role for as long as its token and the credentials it receives remain valid (identity tokens).
Why it matters for AI agents
An agent that deploys code, reads a bucket or queries a database needs credentials. The usual answer is a long-lived key in an environment variable. A sandbox that runs model-written code is the worst place to keep one. A prompt injection can print the key, and a copied key works until someone notices. Google's own documentation calls service account keys "powerful credentials" that "can present a security risk if they are not managed correctly".
With workload identity, the sandbox holds nothing worth stealing for long. It asks for a token when it needs one. The cloud checks who signed the token and what it says, then returns credentials that expire on their own.
Workload identity in facts
| Fact | Value |
|---|---|
| Token format | An OpenID Connect ID token, a signed JSON Web Token |
| Required claims | iss (who issued it), sub (who it is about), aud (who it is for), exp, iat |
| AWS exchange | AssumeRoleWithWebIdentity; needs no AWS credentials to call |
| AWS session length | One hour by default; 900 seconds up to the role's maximum, at most 12 hours |
| Google Cloud exchange | Workload Identity Federation, a federated token traded for a short-lived access token |
| Best-known example | GitHub Actions, whose tokens are "only valid for a single job" |
| Runtime token | 10 minutes by default, 60 to 3600 seconds on request, RS256, audience required |
| Runtime subject | org:<org-id>:image:<image>:sandbox:<sandbox-id> |
How it works on Runtime
Inside a sandbox, request a token. Set the audience to the system that will check the token:
TypeScriptimport { Sandbox } from "withruntime";const { token, subject } = await Sandbox.identityToken({ audience: "sts.amazonaws.com" });console.log(subject, token.length);Pythonfrom withruntime import Sandboxtoken = Sandbox.identity_token("sts.amazonaws.com")print(len(token))In AWS IAM, add https://withruntime.com/oidc as an OpenID Connect provider.
Then write a role trust policy that matches sub. The pattern org:<org-id>:*
admits every sandbox in your organization. The pattern
org:<org-id>:image:api-worker:* admits only sandboxes made from one image. No
other Runtime customer can assume the role (AWS).
Your own API can verify the same token against the published keys at
https://withruntime.com/oidc/jwks.
A sandbox can request tokens only for itself, and only while it runs. That permission ends when the sandbox stops or pauses. The signing keys never leave Runtime's servers. Azure is not supported yet. Entra ID's federated credentials match an exact subject, and every sandbox's subject is different.
Related
- Identity tokens
- Security: identity tokens instead of stored keys
- What are least-privilege API keys?
- How to run untrusted code from an LLM safely
- How to use identity tokens with AWS
- How to run sandboxes from GitHub Actions
Sources
Checked 25 October 2026.
- OpenID Connect Core 1.0: the ID token and its required claims
- AWS STS: AssumeRoleWithWebIdentity: session length and the call's credential needs
- Google Cloud: Workload Identity Federation: service account key risk and the token exchange
- GitHub: OpenID Connect: tokens for a single job
Facts on this page were checked on 25 October 2026.