GitHub Actions OIDC authentication
Authenticate GitHub Actions builds to Snapvisor with short-lived OpenID Connect tokens instead of a long-lived project token.
Instead of a long-lived project token, let GitHub Actions authenticate to Snapvisor with short-lived OpenID Connect tokens minted per workflow run.
Why OIDC
A static ARGOS_TOKEN is a secret you have to store and rotate. With OIDC, GitHub issues a short-lived token scoped to the individual workflow run, and Snapvisor verifies it — there is no persistent secret in your CI configuration.
Enabling it
- Connect the project to its GitHub repository — OIDC is only offered once the repository is linked.
- Turn on GitHub Actions OIDC in the project's settings. Builds from that repository's workflows then authenticate without a project token.
Choosing between the options
If you simply want to drop the secret, plain tokenless authentication is the simplest path. Prefer OIDC when your security policy calls for per-run, verifiable, short-lived credentials.
GitHub tokenless authentication
Let GitHub Actions upload to Snapvisor without an ARGOS_TOKEN environment variable. Learn how tokenless authentication works and when to disable it.
Slack notifications
Connect Snapvisor to Slack so your team hears about visual changes the moment a build lands. Learn how to connect, reconnect, and who can manage it.