> ## Documentation Index
> Fetch the complete documentation index at: https://conductorone-hunner-patch-1.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up workload federation

> Walk through the federation wizard to create a provider and trust, then test your token.

This guide walks through the C1 federation wizard to create a provider and trust. Before starting, you need a service principal -- if you don't have one yet, follow Step 1 of the [client credentials quick start](/product/admin/service-principals/client-credentials#step-1-create-a-service-principal). You don't need to create a credential; federation replaces credentials with OIDC tokens.

## Create a federation trust

<Steps>
  <Step>
    Navigate to **Identities** > **Service principals** and select your service principal.
  </Step>

  <Step>
    On the service principal detail page, select the **Federation** tab.
  </Step>

  <Step>
    Click **Setup federation**.
  </Step>

  <Step>
    Next, choose a provider. Select an existing provider, or create a new one. C1 includes presets for common platforms:

    | Provider | Issuer URL | Notes |
    | :- | :- | :- |
    | **GitHub Actions** | `https://token.actions.githubusercontent.com` | Fixed issuer URL |
    | **GitLab CI/CD** | `https://gitlab.com` (or self-managed URL) | Editable issuer URL |
    | **HCP Terraform** | `https://app.terraform.io` (or custom hostname) | Editable issuer URL |
    | **AWS IAM Outbound** | Account-specific issuer URL | Editable issuer URL |
    | **SPIFFE** | Your trust domain's SPIFFE bundle endpoint | For SPIFFE/SPIRE workload identities |
    | **Custom OIDC** | Any HTTPS issuer URL | For other OIDC-capable platforms |
  </Step>

  <Step>
    Configure the trust. For every provider except Custom OIDC, the wizard collects structured fields (organization, repository, branch, environment, and so on) and generates a CEL expression based on your inputs. You can switch to manual mode to write your own CEL expression. Custom OIDC has no structured fields -- you write the CEL expression directly.

    **Optional.** Add IP restrictions and scoped roles for additional security. See [security controls](/product/admin/service-principals/security) for details.
  </Step>

  <Step>
    Click **Create trust** to finish.
  </Step>

  <Step>
    Copy the **client ID** -- you'll need it in your CI/CD configuration.
  </Step>
</Steps>

## Test your token

Before deploying to production, test the federation trust to make sure your CEL expression matches the expected JWT claims.

<Steps>
  <Step>
    Click the trust in the **Federation** tab to open its detail drawer, then click **Test**.
  </Step>

  <Step>
    Paste a sample JWT from your CI/CD platform, or provide claims as JSON.
  </Step>

  <Step>
    The test runner validates each step:

    | Step | What it checks |
    | :- | :- |
    | JWT decode | Token is valid JWT format |
    | Issuer match | Token issuer matches the provider |
    | Signature validation | Token signature is valid via JWKS |
    | Audience validation | Token audience matches your tenant |
    | Token freshness | Token was issued within the last 10 minutes |
    | CEL evaluation | Your condition expression returns `true` |
    | IP address check | Source IP is in the allowlist (if configured) |
  </Step>
</Steps>

## Platform-specific guides

Once your trust is created, follow the integration guide for your CI/CD platform:

* [GitHub Actions](/product/admin/service-principals/github-actions) -- recommended for GitHub-based workflows
* [GitLab CI](/product/admin/service-principals/gitlab-ci) -- uses GitLab's built-in `id_tokens`
* [HCP Terraform](/product/admin/service-principals/hcp-terraform) -- auto-detected from workspace identity tokens
* [AWS IAM](/product/admin/service-principals/aws-iam) -- outbound identity federation from any AWS workload
* [SPIFFE](/product/admin/service-principals/spiffe) -- SPIFFE/SPIRE workload identities via JWT-SVID
* [Custom OIDC](/product/admin/service-principals/custom-oidc) -- any platform with OIDC support