Solutions Integration

Cloud and CI workload identity

Each platform issues its own identity token. LumoAuth verifies it against the platform's keys, matches it to a registered binding, and issues a LumoAuth token for that agent or service.

Start free Workload federation
app.lumoauth.dev
Workload identity binding

What connects

Clouds and clusters

AWAWS (EKS IRSA) AZAzure GOGoogle Cloud KUKubernetes projected tokens SPSPIFFE JWT-SVID

CI and platforms

GIGitHub Actions GIGitLab CI CICircleCI BUBuildkite AZAzure DevOps TETerraform Cloud CLCloudflare Workers VEVercel ANAny OpenID Connect issuer

How LumoAuth solves it

Register a binding

Platform, issuer, subject pattern and audience. The agent exchanges its platform token in one call. Docs

Which plan you need

GitHub Actions attestation is free on every plan. The other platforms are the Workload identity add-on ($99/month) on Pro and included in Business.

See all plans and add-ons

Documentation

Workload federationdocs.lumoauth.dev/agents/workload-federation Attestationdocs.lumoauth.dev/agents/attestation Kubernetesdocs.lumoauth.dev/integrations/kubernetes-operator

Ship passwordless sign-in this week. Put guardrails on your agents today.

The Developer plan is free for 10,000 monthly users and ten agents, with no card. Everything speaks open standards, so moving in or out is a config change.

Start free Talk to us Read the docs