Workload identity

Use an OIDC principal when a CI system can issue short-lived identity tokens. Use an API key when it cannot.

Register the workload

mthr principal create \
  --name github-ci \
  --id-provider "https://token.actions.githubusercontent.com" \
  --subject "repo:your-org/your-repo:ref:refs/heads/main" \
  --scope "compute:read,compute:session,compute:write"

The issuer, subject, and audience must match the workload token. The default audience is api.mountthor.com. Run mthr principal create with a credential that holds the principals:write and issuers:write scopes; a customer-admin browser session has them. The --scope values above are the scopes the workload’s own sessions receive, not the scopes required to register it.

Exchange a token

Set OIDC_TOKEN from the CI provider and TENANT_ID from mthr api request /v1/admin/account.

printf "%s" "$OIDC_TOKEN" |
  mthr login --tenant "$TENANT_ID" --oidc-token-stdin

The CLI stores the short-lived tenant session. Use normal commands:

mthr vm ls --json

Exchange a new workload token when the session expires.

List and delete principals

mthr principal ls
mthr principal delete PRINCIPAL_ID

Deleting a principal stops new sessions. Existing sessions keep their expiry.

Compute

Platform

API Reference

Register the workload

Exchange a token

List and delete principals

​Register the workload

​Exchange a token

​List and delete principals

Register the workload

Exchange a token

List and delete principals