Skip to main content
env zero now supports a v2 OIDC token format that issues a provider-specific aud (audience) claim for each cloud credential, instead of the same shared audience across AWS, Azure, GCP, and Vault. This prevents a token issued for one provider from being replayed against another, and lets you write cloud IAM trust policies that key off the audience claim.

​
What’s new

  • Provider-specific token audiences for AWS, Azure, GCP, and Vault OIDC credentials, instead of one shared audience across all providers
  • Use v2 OIDC token option on each OIDC credential (AWS, Azure, GCP, Vault), so you opt in per credential
  • Existing v1 credentials keep working unchanged. v2 is opt-in, not a forced migration

​
How it works

  • When creating or editing an OIDC credential, check Use v2 OIDC token to switch that credential to a provider-specific audience (for example, sts.amazonaws.com for AWS).
  • v2 tokens also drop the deprecated https://env0.com/* claims. Use the client_id claim instead if you referenced those claims in trust policies.
  • v1 credentials are unaffected until you opt them in.
Self-hosted agents need v5.2.0 or later. On an older agent, enabling v2 on a credential silently falls back to the v1 audience instead of failing, so confirm your agent version before you rely on the per-provider audience.
Learn more: OIDC integrations: token versions