GitHub Actions OIDC "Unable to get ACTIONS_ID_TOKEN_REQUEST_URL"

By Kaveh Alemi·Latchkey

The OIDC token environment variables are only injected when the job has id-token: write. Without that permission the request URL is unset.

What this error means

A cloud-login or OIDC step fails saying it cannot get ACTIONS_ID_TOKEN_REQUEST_URL or the related env var is empty.

Error: Unable to get ACTIONS_ID_TOKEN_REQUEST_URL env variable

Common causes

id-token permission not granted

OIDC tokens require id-token: write; without it the runtime does not set the request URL.

Permission set at the wrong scope

Granting id-token only at workflow level but overriding job permissions can drop it for the job.

How to fix it

Grant id-token write to the job

1. Add permissions: id-token: write to the job using OIDC.
2. Keep contents: read alongside it if needed.

permissions:
  id-token: write
  contents: read

How to prevent it

• Add id-token: write to every job that uses cloud OIDC login.
• Be careful that job-level permissions do not drop the inherited id-token scope.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions