API authentication with federated tokens, not personal access tokens
Nagisa Kojima
As a secure way to trigger a pipeline as a specific person. Related to the request below (Trigger a pipeline as a specific user):
- Users want to trigger a pipeline outside CircleCI
Currently, personal API tokens are needed to trigger a pipeline through the API.
- Asking each user to feed the CircleCI token is not feasible; it heavily degrades system security.
- Use of a token for a machine user is not ideal, because API calls will be authenticated as the machine user, making it impossible to distinguish who triggered which pipeline on CircleCI.
Federated tokens solve the challenge:
- Accept federated tokens issued by some party in API calls.
- Then API calls will be authenticated as the subject of the token.
- The external app needs to think about a secure way to obtain the federated token, but that shouldn't be a difficult issue