Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.envzero.com/llms.txt

Use this file to discover all available pages before exploring further.

env zero OIDC token contains a unique Subject Identifier per env zero Organization. There are three methods for retrieving your subject identifier. A. From the Credential Form
B. From the App
C. Use Run Task
D. Use env zero OIDC script template
E. Manually from env zero deployment

​
A. From the Credential Form

When creating an OIDC credential in the organization credentials page you can see the sub value in the last disabled form input:
OIDC credential form showing the subject identifier displayed in a disabled input field

​
B. From the App

Go to Organization Settings -> Policies
Next to the “Enable OIDC” checkbox, click “show” ( the “show” button will only appear if OIDC is enabled ) Organization Settings Policies page showing the Enable OIDC checkbox and Show subject identifier button

​
C. Use Run Task

This simple node script will help decode the OIDC Token.
  1. “Enable OIDC”
    1. Under Organization > Settings > Policy - Check “Enable OIDC during deployments”\ Organization Settings Policy page showing Enable OIDC during deployments checkbox
  2. Run a Task - under any existing env zero environment, select “Run a Task” from the env zero environment menu. Note: You will need administrative access to see this option.
  3. Copy and Paste this script:
node -e "console.log(JSON.parse(Buffer.from(process.env.ENV0_OIDC_TOKEN.split('.')[1], 'base64')));"
  1. Hit Run a Task and open the console outputs under “Task Commands” step.

​
D. Using env zero OIDC Script Template

This env zero template, will run a decode script to help you view the contents of the OIDC token.
  1. “Enable OIDC”
    1. Under Organization > Settings > Policy - Check “Enable OIDC during deployments”\ Organization Settings Policy page showing Enable OIDC during deployments checkbox
  2. Clone or Fork the Repo: https://github.com/env0/customer-tools
  3. Run an Environment - from VCS, and configure it with the repo you’ve cloned/forked to, and the folder path: iam/oidc/decode-oidc
  4. This will generate a step in the deployment that outputs the OIDC contents similar to this screenshot:

​
E. Manually from env zero deployment

To retrieve your organization’s unique Subject Identifier:
  1. “Enable OIDC”
    1. Under Organization > Settings > Policy - Check “Enable OIDC during deployments”\ Organization Settings Policy page showing Enable OIDC during deployments checkbox
  2. Go to an existing environment and “Run a Task”\ Environment page menu showing Run a Task option
  3. Run the following command: echo $ENV0_OIDC_TOKEN | base64\ Run a Task terminal showing the echo OIDC token command being entered Deployment task output showing the base64-encoded OIDC token string
  4. Copy and Base64 Decode the Token: echo “ZVXMU5pSXNJblI1Y0NJNklrcFhWQ0lzSW10cFpDSTZJazETmEwWkdU…” | base64 -d Terminal showing the base64 decode command for the OIDC token
  5. Copy the Token and Inspect the decoded token using jwt.io\ jwt.io token inspector showing decoded OIDC token payload with sub and other claims
  6. Copy the Subject Identifier ”sub” (In this example: auth0|632b8219674bde0224a96141)

​
Next steps