Tuist accounts can now trust workloads from any OpenID Connect identity provider that publishes its signing keys over HTTPS, in addition to GitHub Actions, CircleCI, and Bitrise. In the Workload identities section of your account's Settings → Authentication page, configure the provider's issuer URL, its JWKS URL, the audience, and the exact claims a token must carry, then add the trust policy. Saved identities appear as cards with their configuration details visible and individual removal controls. Configure an identity once for organization-wide CI access to all current and future projects in the account, without selecting projects individually. Only workloads whose tokens are signed by that provider and match every claim can exchange them for short-lived CI access; the token cannot administer the account or access another account's projects.
Fly.io Machines work out of the box: trust your Fly organization's issuer with its org_id and app_id claims, request an identity token with audience tuist from the Machine's local Fly API, and pass it through TUIST_OIDC_TOKEN to tuist auth login or mix tuist.login. Set TUIST_OIDC_ACCOUNT to the Tuist account that owns the project; it's required for every trust policy exchange. No repository connection or long-lived Tuist secret is needed.
See the workload identity guide and the Fly.io example. Tuist sessions last one hour without refresh tokens. Removing a policy stops new exchanges; already-issued Tuist access tokens remain valid until they expire.