OIDC federation and Sign in with 1Claw

1Claw publishes a standard OpenID Connect issuer at https://api.1claw.co. That means an external relying party (Anthropic Workload Identity Federation, GCP STS, AWS STS) can validate a 1Claw-issued token against public keys instead of holding a long-lived shared secret.

• GET /.well-known/openid-configuration: the issuer metadata.
• GET /.well-known/jwks.json: the public signing keys.
• Agent JWTs are signed EdDSA; federation tokens are RS256 from an HSM-backed RSA-2048 KMS key.
• Each active key version publishes under a deterministic kid: eddsa-vN and rs256-vN.

1. 1

   Read the issuer metadata. No auth required; this is what the relying party fetches.

   bash Copy

   curl -s https://api.1claw.co/.well-known/openid-configuration | jq
   curl -s https://api.1claw.co/.well-known/jwks.json | jq '.keys[].kid'

2. 2

   Enable federation on the agent and allowlist exactly one audience.

   bash Copy

   1claw agent update $AGENT_ID \
     --federation-enabled \
     --federation-audiences "https://api.example.com" \
     --federated-token-ttl 900

3. 3

   Exchange the agent credential for a federated token using RFC 8693 token exchange.

   bash Copy

   curl -s -X POST https://api.1claw.co/v1/auth/federated-token \
     -H "Content-Type: application/json" \
     -d '{
       "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
       "subject_token": "'$ONECLAW_AGENT_KEY'",
       "subject_token_type": "urn:ietf:params:oauth:token-type:access_token",
       "audience": "https://api.example.com"
     }'

4. 4

   Present the resulting RS256 JWT to the external service, which validates it against the JWKS.

   bash Copy

   curl -s https://api.example.com/v1/data \
     -H "Authorization: Bearer <federated-token>"

Separately, 1Claw can act as an OAuth2 authorization server, "Sign in with 1Claw", with PKCE-required authorize, token, and userinfo endpoints under /v1/oauth. That is for signing users into your app, whereas federation is for machine identity at a service boundary.

Where this goes wrong in practice. Federation removes a static credential and replaces it with a validation contract, and the failures are all in the validation half.

• The audience is not checked. A signature proves the issuer, not the intended recipient, and any customer of the same issuer can mint a validly signed token. Checking aud is what makes federation safe rather than merely convenient.
• A kid is pinned. Pinning one key from the JWKS works until rotation, then fails everywhere at once, at a moment nobody connects to a key rotation.
• The audience allowlist is left empty and assumed permissive. Empty means deny all, which is the safe default and the opposite of what people assume when a call unexpectedly fails.
• Clock skew is not tolerated. Short TTLs make exp checks tight, and a relying party with a fast clock rejects tokens that are minutes from being issued.
• The JWKS is fetched per request. It is stable and cacheable, and fetching it on every call turns the issuer into a hard dependency of your request path.