Workload Identity Federation (Anthropic)
Credentials | Workload Identity Federation
Workload Identity Federation (WIF) lets the gateway authenticate to Anthropic without a static, long-lived API key. Instead, Axemere acts as a trusted OIDC issuer: Anthropic mints short-lived tokens directly to the gateway based on a trust relationship you configure once, in Anthropic's own Console. There's no secret for Axemere to store or for you to rotate.
This guide walks through the one-time setup: what to prepare in Anthropic's Console before you start, then each step of the console's guided wizard (Credentials → Set up with Workload Identity Federation), matched field-by-field to what Anthropic's own "Connect workload" wizard shows.
Table of Contents
- Prerequisites
- Step 1: Issuer
- Step 2: Federation rule
- Step 3: Target
- Step 4: Test
- Status values
- Troubleshooting
- Related Topics
Prerequisites
Set these up in Anthropic's Console first. Nothing below requires Axemere — do this before you open our wizard, so you're not switching back and forth mid-setup.
A dedicated workspace
WIF targets a specific, named workspace — not Anthropic's Default workspace, whose literal
default ID is deprecated for this purpose. If you don't already have a workspace you want to
dedicate to this gateway, create one: Settings → Workspaces → Create workspace.
A dedicated service account
WIF mints tokens on behalf of a service account, a distinct object from a personal or project-scoped API key. If you've only ever used API keys directly, you likely don't have one yet — create one under Settings → Service accounts (or wherever API/member management lives in your Console; Anthropic's navigation varies by org type).
Your Anthropic Organization ID
You'll need this for the federation rule's Expected audience field. Get it from
Settings → Organization — the page
shows a field literally labeled "Organization ID" (a UUID like 7aa83c8e-8c45-40a9-b63e-e0e2f342da39).
Get this value from that exact page, not from anywhere else. This is the single most consequential field in the whole setup, and the easiest to get subtly wrong — any UUID-shaped value "looks right" enough to paste in without noticing it's not the one Anthropic actually uses to resolve your federation rule. A wrong value here produces a 401 that looks identical to every other kind of failure (see Troubleshooting) and gives no indication it's specifically the audience that's wrong.
With those two objects created and your Organization ID in hand, open Credentials in the Axemere console and click Set up with Workload Identity Federation. Name the credential and set its scope (Org Default, or specific workloads/projects — same scope rules as any other credential), then Continue.
Step 1: Issuer
In Anthropic's Console, choose Connect a new provider → Custom OIDC for your first WIF credential (every one after that can reuse the same registered issuer via Use a registered issuer — Axemere uses one shared issuer per org). Our wizard displays the exact values to paste:
| Anthropic field | Where it comes from |
|---|---|
| Name | Pre-filled suggestion from our wizard |
| Issuer URL (iss claim) | Pre-filled — unique to your org |
| JWKS source | Switch off "OIDC discovery" to the explicit JWKS URL option |
| JWKS URL | Pre-filled, shown once you switch off discovery |
| Discovery base URL | Leave blank |
| CA certificate | Leave blank |
| Enforce single-use tokens (JTI replay protection) | Leave on (the default) |
| Maximum token lifetime (hours) | Leave Anthropic's own default (1 hour) unless you have a specific reason to change it |
Step 2: Federation rule
| Anthropic field | Where it comes from |
|---|---|
| Rule name | Pre-filled suggestion from our wizard |
| Match configuration | Pattern match (not CEL expression) |
| Subject pattern | Pre-filled — a prefix match scoped to your org |
| Expected audience | Your Anthropic Organization ID (see Prerequisites) — this field is labeled optional in Anthropic's UI, but leaving it blank rejects every request from this credential; see Troubleshooting |
| OAuth scope | workspace:developer — the least-privileged of Anthropic's two real options (the other, org:admin, is full administrative access and should not be used here) |
| Target → Service account | The service account from Prerequisites |
| Authorization → Enable in all workspaces | Leave unchecked |
| Authorization → Workspaces | Your dedicated workspace from Prerequisites — never the deprecated default |
| Token lifetime | Set this explicitly — our wizard pre-fills a recommended value. Don't leave Anthropic's own wizard on its 10-minute (600s) default, which forces a token re-exchange roughly every 8 minutes |
Step 3: Target
Back in our wizard, enter the real Service account ID and Workspace ID Anthropic assigned when you created them in Prerequisites — not their display names. Click Save & verify: this is the actual write. Our console runs a real verification exchange against Anthropic immediately and only marks the credential active on success.
Step 4: Test
Run Anthropic's own Test step in their Console first — it catches a configuration typo before any real token exchange is attempted. Then use our wizard's Re-verify, which exercises the real gateway exchange path end to end; this is the only check that actually confirms the gateway can mint and use a token. A credential detail page in the console also keeps a persistent Re-verify action, since your Anthropic-side configuration can change (or break) independently of anything on our side.
Status values
| Status | Meaning |
|---|---|
pending_federation | Credential created; setup not finished yet (steps 2-4 still pending) |
active | Working — verification succeeded |
verification_failed | The last verify attempt failed. The wizard shows the exact iss/sub/aud values presented, so you can check them against your Anthropic rule |
Troubleshooting
Verification fails with a generic 401 and no detail, even though every field looks right.
This is almost always a wrong Expected audience / Organization ID — not a blank one (see
below), a wrong one. Anthropic's own token-exchange endpoint returns the exact same opaque 401
authentication_error ("Authentication failed") for every kind of denial, deliberately, so it
can't be used to probe your rule configuration — a mismatched audience, a mismatched subject, or
an unrecognized rule all look identical from here.
The one reliable way to tell a wrong-audience failure apart from everything else: open
Workload identity federation → Authentication events
in Anthropic's Console, filter to your issuer, and widen the range to 24 hours. If your verify
attempt produced a real response (our wizard shows real iss/sub/aud values and an
Anthropic request_id) but does not appear in this log at all, Anthropic never resolved your
organization from the token — meaning the aud claim doesn't match a real Anthropic
organization. Re-check your Organization ID directly against
Settings → Organization; don't trust a
UUID from any other source, even one that looks plausible.
Verification fails because Expected audience is blank. A narrower version of the same
problem: Anthropic's own help text says a blank field defaults to https://api.anthropic.com —
but Axemere's minted tokens always carry your Organization ID as the audience, never that
default. A blank field silently rejects every request from this credential, not just a wider
match. Set it explicitly (see Step 2).
The subject pattern doesn't match. Confirm you used Pattern match, not a CEL expression, and that you pasted the exact value our wizard showed rather than retyping it.
A re-exchange happens surprisingly often. Check the federation rule's token lifetime in Anthropic's Console — if it's still on Anthropic's own 10-minute default, see Step 2.
Related Topics
- Credentials — credential modes, scoping, and the console's general credential management