Workload Identity for GitHub Actions

A GitHub Actions job can get an OIDC token from GitHub for each run. Dodo Payments trusts this token through a github_actions provider.

Provider Settings

Setting	Value
Provider type	`github_actions`
Issuer	`https://token.actions.githubusercontent.com` (fixed)
Audience	`https://live.dodopayments.com` or `https://test.dodopayments.com`
Replay protection	Each JWT can do one exchange (`jti`).
JWT lifetime	1 hour or less.

Required Claims

The mapping must pin repository_owner_id or repository_id with an exact numeric value. A repository name can pass to a new owner after a delete, but a numeric id cannot. The dashboard can find the repository_id from the repository name. Add other conditions to limit the trust, for example:

[
  { "claim": "repository_id", "value": "987654321" },
  { "claim": "ref", "value": "refs/heads/main" },
  { "claim": "environment", "value": "production" }
]

Useful claims are repository, repository_owner, ref, ref_type, environment, event_name, workflow_ref, job_workflow_ref, and sub, for example repo:acme/billing:environment:production.

Dodo Payments refuses JWTs from the pull_request_target and workflow_run events, with the event_not_allowed reason. A run of these events can execute code from a fork with the identity of the base repository.

Workflow

Give the job the id-token: write permission. The SDK uses ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN, which GitHub sets when the job has this permission.

name: Sync products
on:
  push:
    branches: [main]

jobs:
  sync:
    runs-on: ubuntu-latest
    environment: production
    permissions:
      id-token: write
      contents: read
    env:
      DODO_PAYMENTS_IDENTITY_PROVIDER_ID: wip_...
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - run: npm ci
      - run: node scripts/sync-products.js

To get the JWT without an SDK, request it with the Dodo Payments audience:

PLATFORM_JWT=$(curl -sS -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
  "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=https://live.dodopayments.com" | jq -r .value)

Then send it to the exchange endpoint. Refer to Raw HTTP Exchange.

SDK Usage

import DodoPayments from 'dodopayments';

const client = new DodoPayments({
  environment: 'live_mode',
  workloadIdentity: {
    identityProviderId: process.env.DODO_PAYMENTS_IDENTITY_PROVIDER_ID,
    provider: DodoPayments.workloadIdentity.githubActions(),
  },
});

import os
from dodopayments import DodoPayments
from dodopayments.workload_identity import WorkloadIdentity, github_actions

client = DodoPayments(
    environment="live_mode",
    workload_identity=WorkloadIdentity(
        identity_provider_id=os.environ["DODO_PAYMENTS_IDENTITY_PROVIDER_ID"],
        provider=github_actions(),
    ),
)

client := dodopayments.NewClient(
	option.WithEnvironmentLiveMode(),
	option.WithWorkloadIdentity(option.WorkloadIdentity{
		IdentityProviderID: os.Getenv("DODO_PAYMENTS_IDENTITY_PROVIDER_ID"),
		Provider:           workloadidentity.GitHubActions(""),
	}),
)

The helper requests a new JWT for each exchange, thus a long job can refresh its Dodo token. Refer to SDK Usage for the other languages.

Getting Started

Features

Integrate

Merchant of Record

Miscellaneous

Provider Settings

Required Claims

Workflow

SDK Usage

​Provider Settings

​Required Claims

​Workflow

​SDK Usage

Provider Settings

Required Claims

Workflow

SDK Usage