***audience (`aud`) claim**

The`aud` claim is the Client ID, which is the URL of the Codefresh platform instance.

The`aud` claim is the Client ID, which isby defaultthe URL of the Codefresh platform instance. It can also be a custom audience claim, or a list of comma-separated custom audience claims.

***subject (`sub`) claim**

The`sub` claim is a string value concatenated from the different claims representing the precise authentication and authorization required for access.

***issuer (`iss`) claim**

Obtain the ID token from the Codefresh OIDC provider to authenticate and authorize pipeline actions. Codefresh makes this simple by offering a dedicated Marketplace step, the`obtain-oidc-id-token` step, which you can seamlessly add to your pipeline, without the need for additional configuration or parameters on your part.

You can also use this step with custom`aud` claims to override the default configured.

{% include

1. Makes an API call to the Codefresh OIDC provider passing the`CF_OIDC_REQUEST_TOKEN` and the`CF_OIDC_REQUEST_URL` variables.

Codefresh injects these two variablesfor every pipeline build, ensuring their availability for use, regardless of the cloud provider's authentication mechanism, whether it's OIDC ID tokens or static credentials.

Codefresh injects these two variablesinto every pipeline build, ensuring their availability for use, regardless of the cloud provider's authentication mechanism, whether it's OIDC ID tokens or static credentials.

Example:

*`CF_OIDC_REQUEST_TOKEN` is an access token used to request the OIDC ID token for the OIDC provider.

*`CF_OIDC_REQUEST_URL` is the URL from which to request the ID token.

You can also insert the`curl` command as an API call in a freestyle step to get the same result.

You can also insert the`curl` command as an API call in a`freestyle` step to get the same result.

{:start="2"}

1. Sets the ID token in the`ID_TOKEN` environment variable.

You can use this environment variable in subsequent steps within the same pipeline.

<br>

**Custom`aud` claims with the`obtain-oidc-id-token` step**

Instead of configuring the URL of the Codefresh platform URL as the`aud` claim, you can pass single or multiple strings as custom audiences in the`obtain-oidc-id-token` step.

Here are examples of using single and multiple`aud` claims in the`obtain-oidc-id-token` step.

* Single custom`aud` claim

obtain_id_token:

title:Obtain ID Token

type:obtain-oidc-id-token

arguments:

AUDIENCE:"cosign"

You can also do this via a simple API call in a `freestyle` step as follows:

`curl -H "Authorization:$CF_OIDC_REQUEST_TOKEN" "$CF_OIDC_REQUEST_URL?audience=cosign"`