Workload Identity for a Custom OIDC Issuer

Use a custom provider for an issuer that has no built-in type, for example a self-hosted identity provider or a CI system with OIDC support.

Provider Settings

Setting	Value
Provider type	`custom`
Issuer	Any HTTPS URL. The `iss` claim must be equal to this value.
Audience	Must be `https://live.dodopayments.com` or `https://test.dodopayments.com`
Keys	The default discovery endpoint of the issuer, a `discovery_url`, or uploaded keys (JWKS)
Replay protection	Not enforced. The audience and the `sub` pin replace it.
JWT lifetime	1 hour or less.

A custom provider cannot use the issuer host of a built-in type, for example token.actions.githubusercontent.com or gitlab.com. Use the built-in type for these issuers.

Keys

Select one key source:

Discovery (default). Dodo Payments reads the discovery document of the issuer and its jwks_uri. The issuer in the discovery document must be equal to the issuer of the provider.
Discovery URL. Enter a discovery_url when the discovery document is not at the default location.
Uploaded keys. For an issuer with no public JWKS, upload a JWKS. It must have 1 to 20 public keys, with a size of 64 KB or less. Each key must have a kty of RSA, EC (P-256 or P-384), or OKP (Ed25519). Private key members are not permitted.

Dodo Payments gets the remote keys over HTTPS only. It does not follow redirects, and it refuses private IP addresses. The JWKS must have a minimum of one key with a kid and a permitted algorithm.

Required Claims

The mapping must pin sub with an exact value:

[
  { "claim": "sub", "value": "service:billing-worker" }
]

The JWT must have kid in its header, and iss, aud, sub, iat, and exp in its payload. Refer to Verification Rules.

SDK Usage

Write the JWT to a file, and point DODO_PAYMENTS_IDENTITY_TOKEN_FILE to it. The file() helper reads the file for each exchange.

import DodoPayments from 'dodopayments';

const client = new DodoPayments({
  environment: 'live_mode',
  workloadIdentity: {
    identityProviderId: process.env.DODO_PAYMENTS_IDENTITY_PROVIDER_ID,
    provider: DodoPayments.workloadIdentity.file(),
  },
});

import os
from dodopayments import DodoPayments
from dodopayments.workload_identity import WorkloadIdentity, file

client = DodoPayments(
    environment="live_mode",
    workload_identity=WorkloadIdentity(
        identity_provider_id=os.environ["DODO_PAYMENTS_IDENTITY_PROVIDER_ID"],
        provider=file(),
    ),
)

client := dodopayments.NewClient(
	option.WithEnvironmentLiveMode(),
	option.WithWorkloadIdentity(option.WorkloadIdentity{
		IdentityProviderID: os.Getenv("DODO_PAYMENTS_IDENTITY_PROVIDER_ID"),
		Provider:           workloadidentity.File(""),
	}),
)

You can also send the JWT to the exchange endpoint yourself. Refer to Raw HTTP Exchange.

Getting Started

Features

Integrate

Merchant of Record

Miscellaneous

Provider Settings

Keys

Required Claims

SDK Usage

​Provider Settings

​Keys

​Required Claims

​SDK Usage

Provider Settings

Keys

Required Claims

SDK Usage