> ## Documentation Index
> Fetch the complete documentation index at: https://docs.envzero.com/llms.txt
> Use this file to discover all available pages before exploring further.

# V2 OIDC Tokens: Per-Cloud-Provider Audiences

> OIDC credentials for AWS, Azure, GCP, and Vault can now use a provider-specific token audience instead of a single shared audience across all providers.

env zero now supports a v2 OIDC token format that issues a provider-specific `aud` (audience) claim for each cloud credential, instead of the same shared audience across AWS, Azure, GCP, and Vault. This prevents a token issued for one provider from being replayed against another, and lets you write cloud IAM trust policies that key off the audience claim.

## What's new

* **Provider-specific token audiences** for AWS, Azure, GCP, and Vault OIDC credentials, instead of one shared audience across all providers
* **Use v2 OIDC token** option on each OIDC credential (AWS, Azure, GCP, Vault), so you opt in per credential
* Existing v1 credentials keep working unchanged. v2 is opt-in, not a forced migration

## How it works

* When creating or editing an OIDC credential, check **Use v2 OIDC token** to switch that credential to a provider-specific audience (for example, `sts.amazonaws.com` for AWS).
* v2 tokens also drop the deprecated `https://env0.com/*` claims. Use the `client_id` claim instead if you referenced those claims in trust policies.
* v1 credentials are unaffected until you opt them in.

<Warning>
  Self-hosted agents need v5.2.0 or later. On an older agent, enabling v2 on a credential silently falls back to the v1 audience instead of failing, so confirm your agent version before you rely on the per-provider audience.
</Warning>

Learn more: [OIDC integrations: token versions](/guides/integrations/oidc-integrations#token-versions-v2-per-provider-audience-and-v1-legacy)