Authenticating TeamCity Builds to External Services With OIDC - The JetBrains Blog

TeamCity’s OIDC JWT plugin enables CI/CD builds to authenticate with external services such as AWS and Google Cloud using short-lived OpenID Connect tokens rather than static credentials, reducing risks from leaked secrets, sharing, and credential rotation. OIDC works by having an identity provider issue signed JWTs containing claims such as issuer, audience, and expiration, which token consumers validate through public signing keys published in a metadata document and JWKS before granting workload access or exchanging tokens for temporary credentials. The plugin allows TeamCity to act as an identity provider, supports RSA and ECDSA signing, key rotation, configurable issuer URLs for private instances, and extensibility for external key systems such as HSMs or cloud KMS services. Available for TeamCity 2025.11 and later with Java 17, it can issue tokens as build parameters at build start with configurable lifetimes or generate fixed five-minute tokens on demand through HTTP requests for long-running builds, with audiences and setup requirements determined by each destination service.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.