Skip to main content
Most cloud providers allow configuring trust relationships with external identity providers by using industry-standard protocols such as OAuth 2.0, OpenID Connect (OIDC) and SAML. This enables secure authentication across cloud boundaries. Nebius AI Cloud allows you to produce ID tokens for your workloads. You can use these tokens to set up trust relationships based on the OIDC Discovery mechanism.

​
How it works

In the supported flow:
  1. A workload runs in Nebius AI Cloud, for example, on a Compute virtual machine (VM).
  2. The workload gets a Nebius IAM access_token.
  3. The workload exchanges its Nebius access token for a signed ID token through Nebius Security Token Service (STS) https://sts.nebius.com by using the /oauth2/token/exchange endpoint and sends the token to the target system.
  4. The target system evaluates the ID token against its trust policy and, if accepted, either authorizes the workload directly or issues short-lived credentials.
  5. The workload uses the resulting authorization or credentials to access the external resource.
Nebius STS is an HTTP-based service that exchanges identity credentials for short-lived Nebius access tokens or OIDC ID tokens. Nebius STS also exposes an OIDC discovery endpoint at /.well-known/openid-configuration. Target systems use it to validate ID tokens issued by the service.The /oauth2/token/exchange endpoint is based on OAuth 2.0 Token Exchange (RFC 8693) and accepts the following parameters:Supported token types:Nebius STS returns the issued token in the access_token field of the token exchange response for OAuth compatibility. To verify that you received an ID token, check that issued_token_type is urn:ietf:params:oauth:token-type:id_token.

​
Supported flows

Any platform that supports OIDC Discovery can establish trust with this identity provider and validate the issued ID tokens. For an example of how such a trust relationship can be established with Google Cloud, see Configuring access to Google Cloud for Nebius AI Cloud workloads.

​
Security recommendations

  • Never log raw Nebius IAM tokens, Nebius id_token values, external cloud access tokens or other short-lived credentials.
  • Use dedicated audiences per destination, client and environment: for example, separate audiences for development, staging and production.

​
Limitations

  • The workload must be able to obtain a Nebius IAM access_token, for example through the instance metadata service, a service account authorized key or another supported authentication method.
  • The external platform must be able to reach https://sts.nebius.com to verify ID tokens by using the OIDC Discovery mechanism.