> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dodopayments.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Workload Identity for GitLab CI/CD

> Call the Dodo Payments API from a GitLab CI/CD job with a GitLab ID token, on GitLab.com or a self-managed GitLab instance.

A GitLab CI/CD job can get an ID token from GitLab. Dodo Payments trusts this token through a `gitlab` provider.

## Provider Settings

| Setting | Value |
| - | - |
| Provider type | `gitlab` |
| Issuer | `https://gitlab.com`, or the URL of your self-managed GitLab |
| Audience | `https://live.dodopayments.com` or `https://test.dodopayments.com` |
| Replay protection | Each JWT can do one exchange (`jti`). |
| JWT lifetime | 1 hour or less. |

## Required Claims

The mapping must pin `namespace_id` or `project_id` with an exact numeric value.

```json theme={null}
[
  { "claim": "project_id", "value": "42424242" },
  { "claim": "ref", "value": "main" },
  { "claim": "ref_protected", "value": "true" }
]
```

Other useful claims are `namespace_path`, `project_path`, `ref_type`, `pipeline_source`, `environment`, and `sub`.

## Job Configuration

Define an ID token with the Dodo Payments audience in `.gitlab-ci.yml`. GitLab sets it as an environment variable of the job.

```yaml expandable theme={null}
sync-products:
  image: node:22
  id_tokens:
    DODO_PAYMENTS_ID_TOKEN:
      aud: https://live.dodopayments.com
  variables:
    DODO_PAYMENTS_IDENTITY_PROVIDER_ID: wip_...
  script:
    - npm ci
    - node scripts/sync-products.js
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
```

The `gitlab()` helper reads `DODO_PAYMENTS_ID_TOKEN`. If you use a different variable name, give the name to the helper.

Each job gets one ID token, and the token can do one exchange. A job that runs longer than the Dodo token lifetime cannot refresh with the same ID token.

## SDK Usage

```typescript TypeScript theme={null}
import DodoPayments from 'dodopayments';

const client = new DodoPayments({
  environment: 'live_mode',
  workloadIdentity: {
    identityProviderId: process.env.DODO_PAYMENTS_IDENTITY_PROVIDER_ID,
    provider: DodoPayments.workloadIdentity.gitlab(),
  },
});
```

```python Python theme={null}
import os
from dodopayments import DodoPayments
from dodopayments.workload_identity import WorkloadIdentity, gitlab

client = DodoPayments(
    environment="live_mode",
    workload_identity=WorkloadIdentity(
        identity_provider_id=os.environ["DODO_PAYMENTS_IDENTITY_PROVIDER_ID"],
        provider=gitlab(),
    ),
)
```

```go Go theme={null}
client := dodopayments.NewClient(
	option.WithEnvironmentLiveMode(),
	option.WithWorkloadIdentity(option.WorkloadIdentity{
		IdentityProviderID: os.Getenv("DODO_PAYMENTS_IDENTITY_PROVIDER_ID"),
		Provider:           workloadidentity.GitLab(""),
	}),
)
```

Refer to [SDK Usage](https://docs.dodopayments.com/developer-resources/workload-identity/sdk-usage.md) for the other languages.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.