Runtime OIDC

You can now authenticate to OIDC-compatible cloud providers without storing long-lived credentials. Set runtime.oidc.enabled: true in your Truss config and Baseten mounts a short-lived token into the container, refreshing it at least 5 minutes before it expires.

model_name: oidc-enabled
python_version: py313
runtime:
  oidc:
    enabled: true

Your code exchanges the token with the provider directly, so any OIDC-supporting provider works.

For more information, see our docs.