Skip to content
Go OIDC Zero-Trust

Short-lived GitHub tokens.
No stored secrets.

Exchange an OIDC token for a scoped, short-lived GitHub installation token. No PATs, no long-lived credentials to rotate or leak.

Kickstart in 15 minutes → View on GitHub

License Go OpenSSF Scorecard

Get started

From zero to your first token exchange

1
Configure a GitHub App
Create the App, set permissions, generate a private key.
2
Install the App
Install on the org or repos the token should ever touch.
3
Generate a token
Write a trust policy, call /sts/exchange with an OIDC token.
4
Monitor usage
Watch Prometheus metrics and audit logs for exchanges.

Why github-sts

Zero-trust
OIDC Federation
No stored credentials, identity verified via OIDC JWT validation.
Least-privilege
Policy-based Scoping
YAML trust policies define exact permissions per workload identity.
Multi-app
Multiple GitHub Apps
Route different workloads through different GitHub Apps.