Workload Identity for GitLab CI/CD

A GitLab CI/CD job can get an ID token from GitLab. Dodo Payments trusts this token through a gitlab provider.

Provider Settings

Setting	Value
Provider type	`gitlab`
Issuer	`https://gitlab.com`, or the URL of your self-managed GitLab
Audience	`https://live.dodopayments.com` or `https://test.dodopayments.com`
Replay protection	Each JWT can do one exchange (`jti`).
JWT lifetime	1 hour or less.

Required Claims

The mapping must pin namespace_id or project_id with an exact numeric value.

[
  { "claim": "project_id", "value": "42424242" },
  { "claim": "ref", "value": "main" },
  { "claim": "ref_protected", "value": "true" }
]

Other useful claims are namespace_path, project_path, ref_type, pipeline_source, environment, and sub.

Job Configuration

Define an ID token with the Dodo Payments audience in .gitlab-ci.yml. GitLab sets it as an environment variable of the job.

sync-products:
  image: node:22
  id_tokens:
    DODO_PAYMENTS_ID_TOKEN:
      aud: https://live.dodopayments.com
  variables:
    DODO_PAYMENTS_IDENTITY_PROVIDER_ID: wip_...
  script:
    - npm ci
    - node scripts/sync-products.js
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

The gitlab() helper reads DODO_PAYMENTS_ID_TOKEN. If you use a different variable name, give the name to the helper. Each job gets one ID token, and the token can do one exchange. A job that runs longer than the Dodo token lifetime cannot refresh with the same ID token.

SDK Usage

import DodoPayments from 'dodopayments';

const client = new DodoPayments({
  environment: 'live_mode',
  workloadIdentity: {
    identityProviderId: process.env.DODO_PAYMENTS_IDENTITY_PROVIDER_ID,
    provider: DodoPayments.workloadIdentity.gitlab(),
  },
});

import os
from dodopayments import DodoPayments
from dodopayments.workload_identity import WorkloadIdentity, gitlab

client = DodoPayments(
    environment="live_mode",
    workload_identity=WorkloadIdentity(
        identity_provider_id=os.environ["DODO_PAYMENTS_IDENTITY_PROVIDER_ID"],
        provider=gitlab(),
    ),
)

client := dodopayments.NewClient(
	option.WithEnvironmentLiveMode(),
	option.WithWorkloadIdentity(option.WorkloadIdentity{
		IdentityProviderID: os.Getenv("DODO_PAYMENTS_IDENTITY_PROVIDER_ID"),
		Provider:           workloadidentity.GitLab(""),
	}),
)

Refer to SDK Usage for the other languages.

Getting Started

Features

Integrate

Merchant of Record

Miscellaneous

Provider Settings

Required Claims

Job Configuration

SDK Usage

​Provider Settings

​Required Claims

​Job Configuration

​SDK Usage

Provider Settings

Required Claims

Job Configuration

SDK Usage