OIDC "No OpenID Connect token request URL or token request token" in CI

By Daniel Zoghalchali·Latchkey

The OIDC helper looked for ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN in the environment and they were absent. GitHub only injects them when the job has id-token: write, so the token request never starts.

What this error means

A cloud-login step fails with "Error: No OpenID Connect token request URL or token request token in environment" or "Unable to get ACTIONS_ID_TOKEN_REQUEST_URL".

Error: No OpenID Connect token request URL or token request token in environment.

Common causes

The job lacks id-token: write

Without permissions: id-token: write, GitHub does not set the request URL and token env vars, so no OIDC token can be minted.

A restricted default token permission overrides the job

An org/repo default of read-only permissions, with no explicit grant in the job, leaves id-token unset even though other steps run.

How to fix it

Grant id-token: write to the job

1. Add a permissions block granting id-token: write at the job (or workflow) level.
2. Keep contents: read if the job also checks out code.
3. Re-run so GitHub injects the token request env vars.

permissions:
  id-token: write
  contents: read

Set the grant on the calling job for reusable workflows

The permission must exist on the job that actually requests the token, including when calling a reusable workflow.

jobs:
  deploy:
    permissions:
      id-token: write
    uses: ./.github/workflows/deploy.yml

How to prevent it

• Add id-token: write to any job that logs in to a cloud via OIDC.
• Remember a top-level read-only default does not include id-token.
• Set the grant on the calling job when using reusable workflows.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions