No explainer written for this spec yet. The summary, relations and documented support below are maintained.
A workload identity standard from the CNCF: SPIFFE IDs, X.509 and JWT SVIDs, and a Workload API, implemented by SPIRE.
SPIFFE
A workload identity standard from the CNCF: SPIFFE IDs, X.509 and JWT SVIDs, and a Workload API, implemented by SPIRE.
- Where it stands
- Outside the IETF and OpenID
- Official text
- source
- Documented support
- 4
- Activity
- 1 signals in 90 days
How it relates to other specs
Relations diagram
flowchart LR s_spiffe["SPIFFE"] s_wimse_arch["WIMSE Architecture"] s_spiffe_client_auth["OAuth SPIFFE Client Authentication"] s_workload_identity_practices["Workload Identity Practices"] s_wimse_identifier["Workload Identifier"] style s_spiffe stroke-width:3px s_wimse_arch -->|Works with| s_spiffe s_spiffe_client_auth -->|Builds on| s_spiffe s_workload_identity_practices -->|Works with| s_spiffe s_wimse_identifier -->|Works with| s_spiffe
Documented support
Adoption lists only support stated in official documentation (the vendor's or project's own, or a standards body's page naming it), and a weekly check confirms the cited phrase is still on that page. Experimental, alpha and beta support is counted separately as preview.
Products, identity providers and services
- Istio (Product): Its SPIRE integration guide sets the SPIFFE ID format workloads must use source (verified 2026-11-11)
- Google Cloud (Cloud): Managed workload identities are based on SPIFFE source (verified 2026-11-11)
- Anthropic (Claude API) (Product): Workload identity federation accepts SPIFFE JWT-SVIDs source (verified 2026-11-11)
- OpenAI API (Product): Workload identity federation accepts SPIFFE JWT-SVIDs as subject tokens source (verified 2026-11-11)
Activity
Revisions from the Datatracker, explanations from this site's daily runs, and mailing-list subjects naming the draft.
Explanations on this site
- EditorialOAuth WG
This PR fixes the SPIFFE client authentication example, whose client metadata document would have caused the token request to be rejected.
Read the explanation
The Client ID Metadata Document in the JWT-SVID example had no token endpoint auth method. Under the Client ID Metadata Document draft, the authorization server must then assume none and reject a request with client authentication using invalid_client. The example token request uses a JWT-SVID client_assertion, so it would have failed. The PR adds token_endpoint_auth_methods_supported with the value spiffe_jwt to the example. This is an example fix, not a protocol change.