> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dodopayments.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Workload Identity for GitHub Actions

> Call the Dodo Payments API from a GitHub Actions workflow with the GitHub OIDC token, with no API key stored in GitHub secrets.

A GitHub Actions job can get an OIDC token from GitHub for each run. Dodo Payments trusts this token through a `github_actions` provider.

## Provider Settings

| Setting | Value |
| - | - |
| Provider type | `github_actions` |
| Issuer | `https://token.actions.githubusercontent.com` (fixed) |
| Audience | `https://live.dodopayments.com` or `https://test.dodopayments.com` |
| Replay protection | Each JWT can do one exchange (`jti`). |
| JWT lifetime | 1 hour or less. |

## Required Claims

The mapping must pin `repository_owner_id` or `repository_id` with an exact numeric value. A repository name can pass to a new owner after a delete, but a numeric id cannot. The dashboard can find the `repository_id` from the repository name.

Add other conditions to limit the trust, for example:

```json theme={null}
[
  { "claim": "repository_id", "value": "987654321" },
  { "claim": "ref", "value": "refs/heads/main" },
  { "claim": "environment", "value": "production" }
]
```

Useful claims are `repository`, `repository_owner`, `ref`, `ref_type`, `environment`, `event_name`, `workflow_ref`, `job_workflow_ref`, and `sub`, for example `repo:acme/billing:environment:production`.

> [!WARNING]
>
> Dodo Payments refuses JWTs from the `pull_request_target` and `workflow_run` events, with the `event_not_allowed` reason. A run of these events can execute code from a fork with the identity of the base repository.

## Workflow

Give the job the `id-token: write` permission. The SDK uses `ACTIONS_ID_TOKEN_REQUEST_URL` and `ACTIONS_ID_TOKEN_REQUEST_TOKEN`, which GitHub sets when the job has this permission.

```yaml expandable theme={null}
name: Sync products
on:
  push:
    branches: [main]

jobs:
  sync:
    runs-on: ubuntu-latest
    environment: production
    permissions:
      id-token: write
      contents: read
    env:
      DODO_PAYMENTS_IDENTITY_PROVIDER_ID: wip_...
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - run: npm ci
      - run: node scripts/sync-products.js
```

To get the JWT without an SDK, request it with the Dodo Payments audience:

```bash theme={null}
PLATFORM_JWT=$(curl -sS -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
  "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=https://live.dodopayments.com" | jq -r .value)
```

Then send it to the exchange endpoint. Refer to [Raw HTTP Exchange](https://docs.dodopayments.com/developer-resources/workload-identity/sdk-usage.md#raw-http-exchange).

## SDK Usage

```typescript TypeScript theme={null}
import DodoPayments from 'dodopayments';

const client = new DodoPayments({
  environment: 'live_mode',
  workloadIdentity: {
    identityProviderId: process.env.DODO_PAYMENTS_IDENTITY_PROVIDER_ID,
    provider: DodoPayments.workloadIdentity.githubActions(),
  },
});
```

```python Python theme={null}
import os
from dodopayments import DodoPayments
from dodopayments.workload_identity import WorkloadIdentity, github_actions

client = DodoPayments(
    environment="live_mode",
    workload_identity=WorkloadIdentity(
        identity_provider_id=os.environ["DODO_PAYMENTS_IDENTITY_PROVIDER_ID"],
        provider=github_actions(),
    ),
)
```

```go Go theme={null}
client := dodopayments.NewClient(
	option.WithEnvironmentLiveMode(),
	option.WithWorkloadIdentity(option.WorkloadIdentity{
		IdentityProviderID: os.Getenv("DODO_PAYMENTS_IDENTITY_PROVIDER_ID"),
		Provider:           workloadidentity.GitHubActions(""),
	}),
)
```

The helper requests a new JWT for each exchange, thus a long job can refresh its Dodo token. Refer to [SDK Usage](https://docs.dodopayments.com/developer-resources/workload-identity/sdk-usage.md) for the other languages.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.