TechPrufer
Get started
Atlassian
Atlassian logoAtlassian · Feature trail

Bitbucket Pipelines OIDC Audience Support

2 posts · Dec 2024 – Feb 2026

What this trail covers

Bitbucket Pipelines now supports third-party secrets integration, allowing secure retrieval of secrets directly from external secret stores. This enhances security by preventing secrets from being stored within the Pipelines platform and provides greater control over secret access per repository. The integration works by generating an OIDC token for runners, which is then validated by the secrets integration service to fetch and return secrets from the configured vault. This feature is configurable for both cloud and self-hosted runners and requires enabling OIDC in the pipeline configuration.

All Atlassian trails
  1. Bitbucket Pipelines OIDC now supports multiple audiencesThis post details the addition of multiple audience support to Bitbucket Pipelines OIDC claims. Previously, pipelines could only integrate with a single resource server using their OIDC token. The enhancement allows for up to 10 audiences to be declared, enabling a single identity token to authorize access to multiple distinct resource servers. This simplifies workflows by eliminating the need for separate access tokens for each integration. The post also explains the role of the 'aud' claim in OIDC and provides an example of how to configure multiple audiences in pipeline definitions.
  2. Third-party secrets are now supported in Bitbucket PipelinesThis post introduces the capability for Bitbucket Pipelines to integrate with third-party secret stores. It details the mechanism involving OIDC tokens, runner requests, OIDC validation, and secret fetching/filtering. It also provides configuration instructions for self-hosted and cloud runners, and outlines the requirements for enabling OIDC in pipeline configurations. A demo secret provider integration is referenced for guidance.