Exchange an OIDC token for JFrog access

The jf exchange-oidc-token command (jf eot) swaps an OIDC token ID from your CI identity provider for a JFrog access token and username. It is intended for pipelines where short-lived OIDC credentials are issued inside the job.

📘

Note

: This command is designed for CI/CD pipelines. OIDC tokens are short-lived credentials generated inside a CI job — they cannot be created locally.

Prerequisites

To use this command:

1. Your JFrog Platform administrator must configure the OIDC integration. See Administration > Security > OpenID Connect in the Artifactory UI.
2. Your CI/CD platform must support OpenID Connect (OIDC) identity federation (GitHub Actions, Azure DevOps, or a generic OIDC-compatible provider).
3. The JFrog CLI must be installed and accessible in your CI/CD environment.

Synopsis

jf exchange-oidc-token <oidc-provider-name> <oidc-token-id> [--url=<artifactory-url>] [--oidc-provider-type=<type>]

Where:

• <oidc-provider-name> — Name of the OIDC provider configured in Artifactory.
• <oidc-token-id> — OIDC token ID to exchange (omit if JFROG_CLI_OIDC_EXCHANGE_TOKEN_ID is set).
• <artifactory-url> — Optional. Artifactory base URL; defaults to the configured server if omitted.
• <type> — Optional. Provider implementation: GitHub (default), Azure, or GenericOidc.
• You can add further flags from the Options table (--oidc-audience, --application-key, --project, --repository, and others) as needed.

Aliases: jf eot

Arguments

Options

Environment Variables

Output

On success, the command prints the JFrog access token and the associated username:

{
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9...",
  "username": "[email protected]"
}

Use the returned access_token with jf config add to store the credential for subsequent commands.

Examples

Exchange an OIDC Token

To exchange a provider token for a JFrog access token:

jf eot <oidc-provider-name> <oidc-token-id> --url=<artifactory-url>

Where:

• <oidc-provider-name> and <oidc-token-id> — Values from your OIDC setup and CI job.
• <artifactory-url> — For example https://acme.jfrog.io/artifactory.

Example:

jf eot my-github-provider eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... --url=https://acme.jfrog.io/artifactory

The command prints a JFrog access token and username (see Output).

Use a Non-Default Provider Type

To specify a non-GitHub OIDC provider type:

jf eot <oidc-provider-name> <oidc-token-id> --oidc-provider-type=<type> --url=<artifactory-url>

Where:

• <type> — GitHub, Azure, or GenericOidc.

Example:

jf eot my-oidc-provider eyJhbGciOiJIUzI1NiIs... --oidc-provider-type=Azure --url=https://acme.jfrog.io/artifactory

GitHub Actions Workflow

To exchange an OIDC token from GitHub Actions:

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write   # required to generate an OIDC token
      contents: read
    steps:
      - name: Get OIDC token
        id: oidc
        run: |
          TOKEN=$(curl -sS "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=jfrog-github" \
            -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" | jq -r .value)
          echo "TOKEN=$TOKEN" >> "$GITHUB_OUTPUT"

      - name: Exchange OIDC token for JFrog access token
        run: |
          jf eot my-github-oidc-provider "${{ steps.oidc.outputs.TOKEN }}" \
            --url=https://<your-org>.jfrog.io/artifactory \
            --oidc-provider-type=GitHub

Use Environment Variable for Token ID

To pass the token ID via environment variable:

1. Run:

export JFROG_CLI_OIDC_EXCHANGE_TOKEN_ID=<oidc-token-id>
jf eot <oidc-provider-name> --url=https://<artifactory-host>/artifactory

Where:

• <oidc-token-id> — OIDC token value for the current job.
• <oidc-provider-name> — Configured provider name.
• <artifactory-host> — Your JFrog hostname (for example acme.jfrog.io).

Example:

export JFROG_CLI_OIDC_EXCHANGE_TOKEN_ID=eyJhbGciOiJIUzI1NiIs...
jf eot my-oidc-provider --url=https://acme.jfrog.io/artifactory

When JFROG_CLI_OIDC_EXCHANGE_TOKEN_ID is set, the <oidc-token-id> positional argument can be omitted.

When to Use

Use jf eot (exchange OIDC token) when your CI/CD platform supports OpenID Connect (OIDC) identity federation with JFrog. This is the recommended authentication method for:

• GitHub Actions: Uses GitHub's built-in OIDC provider to generate short-lived tokens
• Azure DevOps: Uses Azure AD as the OIDC provider
• Other OIDC providers: Any provider compatible with the GenericOidc type

OIDC eliminates the need to store long-lived access tokens as CI/CD secrets. Instead, the CI platform generates a short-lived identity token that the CLI exchanges for a JFrog access token.

📘

Note

: OIDC (OpenID Connect) is an identity protocol built on top of OAuth 2.0. See the Prerequisites section for setup requirements.

Troubleshooting

To fix common jf exchange-oidc-token errors: