Trust commands

An OIDC trust lets tokens from an external issuer (e.g. GitHub Actions) authenticate as a service account: tokens whose issuer and subject exactly match the trust are exchanged for short-lived Synthetiq tokens. No credentials are stored anywhere. All trust commands require the org:trusts scope on your organization role.

create

Create a trust on a service account:

synthetiq trust create \
  --service-account-id <service-account-id> \
  --issuer https://token.actions.githubusercontent.com \
  --subject "repo:acme/infra:ref:refs/heads/main"

Flag	Description
`--service-account-id <id>`	The service account this trust authenticates as
`--issuer <url>`	OIDC issuer URL (https, no default)
`--subject <subject>`	Token subject, matched exactly (e.g. `repo:<owner>/<repo>:ref:refs/heads/main`)
`--jwks <path>`	Optional JWK Set file pinning the issuer’s signing keys — verification then never contacts the issuer. Omit to resolve keys via OIDC discovery (issuer must be reachable from the Synthetiq platform; rotation is automatic)
`--description <text>`	Optional description of the trust
`--json`	Output as JSON

Trust created.
  ID:       3c1f8a44-9b2d-4e07-8f1a-6d5c2e9b7a01
  Issuer:   https://token.actions.githubusercontent.com
  Subject:  repo:acme/infra:ref:refs/heads/main

One trust per (issuer, subject) pair per organization.

The subject is matched exactly. Some GitHub organizations emit ID-qualified claims — repo:<owner>@<org-id>/<repo>@<repo-id>:ref:refs/heads/main — and a trust created from the plain form is then rejected with invalid_grant: No OIDC trust is configured for this issuer and subject in the specified organization. Create one trust per form; both can point at the same service account. See CI Integration.

list

List the organization’s trusts:

synthetiq trust list

ID                                     SERVICE ACCOUNT   ISSUER                                        SUBJECT
3c1f8a44-9b2d-4e07-8f1a-6d5c2e9b7a01   infra-apply       token.actions.githubusercontent.com          repo:acme/infra:ref:refs/heads/main

Flag	Description
`--json`	Output as JSON

update

Update an existing trust:

synthetiq trust update <trust-id> [--issuer <url>] [--subject <subject>] [--service-account-id <id>] [--description <text>]

delete

Delete a trust:

synthetiq trust delete <trust-id>

Revocation is immediate — the next token exchange for this issuer and subject fails.

Platform Docs

Synthetiq Desktop

Synthetiq CLI

App Framework

Services Framework

Workflows Framework

Platform API

Deployments

create

list

update

delete

​create

​list

​update

​delete

create

list

update

delete