How do I avoid long-lived API keys in agent code?

#The question

Use project-scoped OIDC federation for workload access to Swirls: inherit an organization identity provider or register one in the project, then exchange its JWT for a short-lived project credential. For third-party calls, use managed connections where supported and secret-backed auth configuration otherwise.

#Who's asking

Security / compliance owner. Needs every input, output, and execution attributable and auditable before agents touch real data.

#Why Swirls is a fit

For inbound OIDC federation, configure a provider on project Auth or explicitly inherit an organization default. Exchange an IdP JWT carrying that project binding's audience for a short-lived project credential. Deployed role and policy blocks can narrow access further. Outbound third-party credentials use connection or auth blocks; those blocks do not register an inbound IdP.

Every agent execution runs with its own identity. Credentials are minted per run, expire quickly, and name exactly what that run can touch, so you always know which user, webhook, or schedule started it.

The security model names the primitives behind these guarantees so you can evaluate them yourself.