OIDC / “trusted publishing” support for wrangler deploys (no long‑lived API tokens)

[Juice10]

Hi folks 👋

First off, thanks for all the work on wrangler and the broader workers-sdk, it's really a pleasure to develop on top of!

As far as I can tell, the current recommended way to deploy from GitHub Actions is:

• Create a long‑lived Cloudflare API token.
• Store it as a GitHub Actions secret (e.g. CLOUDFLARE_API_TOKEN).
• Pass it through to wrangler / wrangler-action in CI.

That works, but it means each repo (or CI environment) ends up holding a powerful, persistent credential.

Across the ecosystem there’s a strong shift toward “trusted publishing” based on OpenID Connect (OIDC) instead of long‑lived static tokens. For example, npm is moving to OIDC‑based trusted publishing from CI providers (GitHub Actions, GitLab, etc.), so you don’t need to mint or store npm tokens in repo secrets anymore.

There’s a good write‑up of that model here (which also links to the npm docs):

https://www.mbgsec.com/archive/2025-09-23-trusted-publishing-for-npm-packages-npm-docs/

For Cloudflare Workers, it would be amazing to have a similar flow for deployments from GitHub Actions:

1. A workflow job has id-token: write and requests an OIDC ID token from GitHub.

2. Either:

   • wrangler itself, or
   • a Cloudflare / Workers auth endpoint

   exchanges that OIDC token for a short‑lived, scoped credential that is valid only for that job/run and has just enough privilege to deploy a specific Worker / project.

3. No long‑lived Cloudflare API token needs to live in GitHub repo/org secrets.

Benefits

• Improved security posture – Eliminates long‑lived Cloudflare API tokens in CI; credentials are short‑lived and bound to a single workflow execution.
• Stronger least‑privilege – Cloudflare can validate claims in the OIDC token (repo, org, branch, workflow, etc.) before issuing deploy rights, aligning access strictly with CI policy.
• Easier setup & rotation – No manual token creation/rotation; onboarding a new repo is just “give this workflow OIDC + the right Cloudflare config”.
• Ecosystem alignment – Matches the “trusted publishing” model that npm and others are adopting as the default.

Questions

1. Is there any existing or planned support for OIDC / workload‑identity‑style auth for Workers deployments from GitHub Actions (or other CI providers)?
2. If this is on the roadmap, is there an issue, RFC, or doc we can follow?
3. If it’s not yet planned, would a design/requirements draft or proof‑of‑concept from the community be useful? And if so, is there any early guidance you can share (preferred OIDC issuers, token claims, expected exchange flow, etc.)?

Having first‑class OIDC support for wrangler deploys would be a big win for anyone trying to keep CI credentials minimal, short‑lived, and auditable. Thanks for considering it!