---
title: debug-oidc-claims
url: /docs/esc/providers/login/debug-oidc-claims/
---


The `debug-oidc-claims` provider previews the claims of an OpenID Connect (OIDC) token from Pulumi ESC. It signs nothing and returns no credential. Use it to find the `iss`, `sub`, and `aud` values that a relying party must trust before you mint a real token with [`fn::open::oidc`](/docs/esc/providers/login/oidc/).

## Workflow

1. Add a `fn::open::debug-oidc-claims` block with the inputs you plan to give `fn::open::oidc`, and save the environment:

```yaml
    values:
      registry:
        login:
          fn::open::debug-oidc-claims:
            audience: https://registry.example.com
            identityToken:
              version: v2
    ```

1. Open the environment, in the Pulumi Cloud console or with [`pulumi env open`](/docs/iac/cli/commands/pulumi_env_open/), and read the claims:

```json
    {
      "registry": {
        "login": {
          "aud": "https://registry.example.com",
          "https://pulumi.com/actor": "<user-login>",
          "https://pulumi.com/actor_id": "<user-id>",
          "https://pulumi.com/current_env": "<project>/<environment>",
          "https://pulumi.com/current_env_id": "<environment-id>",
          "https://pulumi.com/org": "<org-name>",
          "https://pulumi.com/org_id": "<org-id>",
          "https://pulumi.com/root_env": "<project>/<environment>",
          "https://pulumi.com/root_env_id": "<environment-id>",
          "iss": "https://api.pulumi.com/oidc/v2",
          "sub": "pulumi:org:<org-id>:env:<environment-id>"
        }
      }
    }
    ```

1. Copy `iss`, `sub`, and `aud` into the relying party's trust configuration. For examples, see [Configure a relying party for custom-audience OIDC tokens](/docs/esc/guides/configuring-oidc/custom-audience/).

1. Change `fn::open::debug-oidc-claims` to `fn::open::oidc`. Keep the other inputs as they are. The environment now returns a signed token with the claims you previewed.

The preview leaves out `iat`, `nbf`, `exp`, and `jti`. Pulumi sets those claims when it signs a token. For what each claim means, see [Token claims](/docs/esc/guides/configuring-oidc/custom-audience/#token-claims).

## Schema reference

### Inputs

With `identityToken.version` set to `v2`, the provider takes the same inputs as [`fn::open::oidc`](/docs/esc/providers/login/oidc/#inputs), with the same rules:

| Property | Type | Required | Description |
|---|---|---|---|
| `audience` | string | Yes | The `aud` claim to preview. One value, 1 to 255 bytes. |
| `identityToken` | object | Yes | Selects the claims to preview. |
| `identityToken.version` | string | Yes | `v2` previews the `fn::open::oidc` claims. `v1` previews the [vendor login claims](#preview-the-vendor-login-claims). |
| `duration` | string | No | Accepted so that the block moves to `fn::open::oidc` unchanged, from `1m` to `1h`. The preview has no lifetime. |

### Outputs

An object keyed by claim name, holding the claims a token would carry. Nothing is signed.

## Preview the vendor login claims

With `identityToken.version` set to `v1`, the provider previews the claims that the vendor login providers, such as [`aws-login`](/docs/esc/providers/login/aws-login/), send from the `https://api.pulumi.com/oidc` issuer. [Default token claim](/docs/esc/guides/configuring-oidc/#default-token-claim) describes those claims. In this form, set `audiencePrefix` (required) and optionally `subjectAttributes`. The provider refuses `audience` and `duration` here.

```yaml
values:
  preview:
    fn::open::debug-oidc-claims:
      audiencePrefix: aws
      identityToken:
        version: v1
```

This preview omits `iss`, `iat`, and `exp`. The signed vendor tokens carry them.

## Troubleshooting

With `identityToken.version` set to `v2`, the provider refuses the same inputs as `fn::open::oidc`, with `debug-oidc-claims` in the message. See [its troubleshooting section](/docs/esc/providers/login/oidc/#troubleshooting).

### Inputs from the wrong form

**Symptom:** opening fails with `fn::open::debug-oidc-claims accepts audience only with identityToken.version: v2; identityToken.version: v1 takes audiencePrefix`, the same message for `duration`, or `audiencePrefix is required with identityToken.version: v1; set identityToken.version: v2 for the fn::open::oidc claims`.

**Cause:** `identityToken.version` selects the form. With `v2`, the provider takes the `fn::open::oidc` inputs. With `v1`, the provider takes `audiencePrefix` and `subjectAttributes`.

**Fix:** to preview a `fn::open::oidc` token, set `identityToken.version: v2` and remove `audiencePrefix`. To preview the vendor login claims, set `identityToken.version: v1`, remove `audience` and `duration`, and set `audiencePrefix`.

### Version not set

**Symptom:** opening fails with `fn::open::debug-oidc-claims requires identityToken.version: v1 for the vendor login claims or v2 for the fn::open::oidc claims`.

**Cause:** the block has no `identityToken.version`. The provider never guesses which claims to preview.

**Fix:** add `identityToken.version: v2` to preview a `fn::open::oidc` token, or `identityToken.version: v1` to preview the vendor login claims.

### Environment not saved

**Symptom:** opening fails with `fn::open::debug-oidc-claims cannot run in an unsaved environment document; save the environment and import it`.

**Cause:** the `fn::open::oidc` subject uses the environment's ID, and an unsaved environment document has no ID yet.

**Fix:** save the environment that declares the block, then open it.