We Built Render OIDC

Render has described how its OIDC support lets services authenticate to providers such as AWS and GCP without long-lived API tokens. Tokens expire after 60 minutes, and the workspace ID in the issuer URL makes each workspace a separate identity provider. Because most SDKs only read a token file from disk, a daemon outside each container writes refreshed tokens to an in-memory directory bind-mounted read-only into the service. These details come from Render's own account; the claim check found no independent sources.