Octopus - Authenticate with OIDC

To use this template in Octopus Deploy, copy the JSON below and paste it into the Library → Step templates → Import dialog.

{
  "Id": "97a36fb9-7b00-4608-866f-53fd459bcdea",
  "Name": "Octopus - Authenticate with OIDC",
  "Description": "**This step requires Octopus 2025.3.12525 or later.**\n<br /><br />\nThis step uses Octopus an [OpenID Connect](https://octopus.com/docs/infrastructure/accounts/openid-connect) Account to obtain an access token that can be used in place of an API key in requests against the Octopus API.\n<br /><br />\nThe access token is stored in an [Output Variable](https://octopus.com/docs/projects/variables/output-variables) named **AccessToken**.",
  "Version": 1,
  "ExportedAt": "2025-09-02T21:56:43.519Z",
  "ActionType": "Octopus.Script",
  "Author": "ryanrousseau",
  "Packages": [],
  "Parameters": [
    {
      "Id": "057c4820-9052-4d87-860e-4f4ef501fd4a",
      "Name": "AuthenticateWithOIDC.ServerUri",
      "Label": "Octopus Server Uri",
      "HelpText": "The URI of the Octopus Server with which to authenticate.",
      "DefaultValue": "#{Octopus.Web.ServerUri}",
      "DisplaySettings": {
        "Octopus.ControlType": "SingleLineText"
      }
    },
    {
      "Id": "dbcea301-baeb-4ae5-974e-3161695df254",
      "Name": "AuthenticateWithOIDC.OidcAccount",
      "Label": "OIDC Account",
      "HelpText": "The Generic OIDC Account variable used to authenticate with the Octopus Server.",
      "DefaultValue": "",
      "DisplaySettings": {
        "Octopus.ControlType": "GenericOidcAccount"
      }
    }
  ],
  "Properties": {
    "OctopusUseBundledTooling": "False",
    "Octopus.Action.Script.ScriptSource": "Inline",
    "Octopus.Action.Script.Syntax": "PowerShell",
    "Octopus.Action.Script.ScriptBody": "function Invoke-OctopusApi {\n  param(\n    $Uri,\n    $Method,\n    $Body\n  )\n\n  try {\n    Write-Verbose \"Making request to $Uri\"\n\n    if ($null -eq $Body)\n    {\n      Write-Verbose \"No body to send in the request\"\n      return Invoke-RestMethod -Method $method -Uri $Uri -ContentType \"application/json; charset=utf-8\"\n    } \n\n  $Body = $Body | ConvertTo-Json -Depth 10\n  Write-Verbose $Body\n  \n    return Invoke-RestMethod -Uri $Uri -Method $Method -Body $Body -ContentType \"application/json; charset=utf-8\" -ErrorAction Stop\n  }\n  catch {\n    Write-Host \"Request failed with message `\"$($_.Exception.Message)`\"\"\n\n    if ($_.Exception.Response) {\n        $code = $_.Exception.Response.StatusCode.value__\n        $message = $_.Exception.Message\n        Write-Host \"HTTP response code: $code\"\n\n        Write-Host \"Server returned: $error\"\n      }\n\n    Fail-Step \"Failed to make $method request to $uri\"\n  }\n}\n\nif ([string]::IsNullOrWhiteSpace($OctopusParameters[\"AuthenticateWithOIDC.ServerUri\"])) {\n  Fail-Step \"Octopus Server Uri is required.\"\n}\n\nif ([string]::IsNullOrWhiteSpace($OctopusParameters[\"AuthenticateWithOIDC.OidcAccount\"])) {\n  Fail-Step \"OIDC Account is required.\"\n}\n\n$server = $OctopusParameters[\"AuthenticateWithOIDC.ServerUri\"]\n$serviceAccountId = $OctopusParameters[\"AuthenticateWithOIDC.OidcAccount.Audience\"]\n$jwt = $OctopusParameters[\"AuthenticateWithOIDC.OidcAccount.OpenIdConnect.Jwt\"]\n\n$body = @{\n  grant_type = \"urn:ietf:params:oauth:grant-type:token-exchange\";\n  audience = \"$serviceAccountId\";\n  subject_token_type = \"urn:ietf:params:oauth:token-type:jwt\";\n  subject_token = \"$jwt\"\n}\n\n$uri = \"$server/.well-known/openid-configuration\"\n$response = Invoke-OctopusApi -Uri $uri -Method \"GET\"\n$response = Invoke-OctopusApi -Uri $response.token_endpoint -Method \"POST\" -Body $body\n\nSet-OctopusVariable -name \"AccessToken\" -value $response.access_token -sensitive\n\n$stepName = $OctopusParameters[\"Octopus.Step.Name\"]\nWrite-Host \"Created output variable: ##{Octopus.Action[$stepName].Output.AccessToken}\""
  },
  "Category": "Octopus",
  "HistoryUrl": "https://github.com/OctopusDeploy/Library/commits/master/step-templates//opt/buildagent/work/a381802920158308/step-templates/octopus-authenticate-with-oidc.json",
  "Website": "/step-templates/97a36fb9-7b00-4608-866f-53fd459bcdea",
  "Logo": "iVBORw0KGgoAAAANSUhEUgAAAMgAAADICAMAAACahl6sAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAC1QTFRFT6Tl////L5Pg8vj9Y67omsvwPJrisdfzfbzs5fL7y+T32Ov5isLucLXqvt31CJPHWwAABMJJREFUeNrs3deW4jAMAFDF3U75/89dlp0ZhiU4blJEjvQ8hYubLJsA00UCBCIQgQhEIAIRiEAEIhCBCEQgAhGIQAQiEIEIhD8kJm+t+QprfdKfB9HbYpx6CWfspj8HMi+gMgHL/AmQA8W3JTKH+ALFvzCeL0RbpyoCPE9IJeNOSQwh5Z3qd6yRGWQ2qi2cZQWxqj1WzQYSjeoJmJlAklOd4VlArOqPhQEkqBERToeMcfRJBkC0Uep8CfBpjz4JsHJ0zF3dkEWNje0kiB/sUC6eApndaIiCMyAa1PiwJ0AWhRGJHJJQHG2dC7h1rNbO1QOxSA7lNCkkKrQIpJCAB1GREILYIC1NAiwbpKFJgGWDNExcwGstfExcZBCHC6nOglshHtmhViLIig1RNBCN7qjtW8C0Z1UvJcC1Z9XmwMBzzvobmgAyEzgq91dtEEsBsQSQQAFZCSBAATEEEApHZbrVBIkkEIUPSVeB+KtALA0kXQUSrwKZBCIQBnk8Y4i5CsReBeKvkqLM+BCSDWJlrZFvGk9SRTHshkgjZCGAaArIxm3H3grhVzFlW2msfl1ca79UJ1bofYvsDHHlNdTZnlh5MghuPd5NdBDUNZHyCkfktIh03XzALGRPlBDPac7qgWjHZzWcmF5zmmkhidMQ6boKiDXcDTUEaylZqCGJ0Vjvu/fLJtHqhSANEvqb2OYqkOUqEHuVMbJcZdZCGiPhKhC4yjqiIjEE7XThMp8fAWII3mY3kUIQD+AMKQTzPiBhgQ63HlT/KSvgtoi0dq5mCPah1UIE0eh3sT0NhOByvKeAkFzi8PgQomumFhsyOxpIzZN4gLOj5plVwNpR0b2AuePWKBEHQu24pSsJA+LVCeHHQxZ1SiyDIdqok8IOhSSnTottHEQTdyt4ettAj4KkzA4dMikk2Dht2S5ptm1vswnPDxn0YyDZ5oDM3iToo2T5voWaYe+Q+vdjH80QyAzZhCgcDtLMI1Tmtz9w++XHgziHQHJJu/OZ3bs9Xn8gQ72NcP3dKqEfkp10F51xhoIi2I91R+LurXV/5q7pH+wx061CzO16oSQleMyr8fXvwMA0Pro8432DPD/ySx8XrHfSuDAM8n6UhnjQabaiXf5Bq/lREHvEeNtn1rJ08+C/uXkQZHeguxAPC3UvtcJYUogLzZX5hhZZvS6onG5lxXtzWGaygwb79vT/IXhdlNibwlKYOR6T8xjI7W8n+xV7T+GH4tMzWwR+lZhRkJYSsC0thpmCYqyngOz3rN2FLBZ2wZflBCggUHF0Vnp88JKienzIXLSEZCZqU7IKr/gQW9yx3pzV7Y9kvWZWTRRIqDmTtRUnU7b2lLcTYmoqHqnmiO1poER0SPkAeZMAZxaJx0Y3TCdAclsIqDz03ALcyxfTCZBsthoGXWmigGyVhWPLFJJfuuKQWycoEFdXbH4dJJoJxNR1eD/kshz6yn48cF8yW8sFoitflB1w6Q8n+/15Za7oA17/pYNmYgP5fmWm8L1NOHPWgK8kuFew1/JXtOA0yJCv7ah7X8ObUuT5kObU30+fDZm8+zqP+HTIpK0xQ796b5Kv2hSIQAQiEIEIRCACEYhABCIQgQhEIAIRiEAEIpBf8UeAAQAEjtYmlDTcCgAAAABJRU5ErkJggg==",
  "$Meta": {
    "Type": "ActionTemplate"
  }
}

History