Browser playground · no secrets

Watch a credential become useless.

Exchange a GitHub workload identity, call one MCP server, revoke the credential, then retry it. The last request must fail closed.

This is a protocol simulation. It runs entirely in this tab and never mints or accepts a real token. The repository demo uses real GitHub OIDC.

Credential lab

One identity. One resource. One short lifetime.

Workload subject MCP resource Scope Lifetime

01
Exchange identityGitHub OIDC → scoped credential
waiting
02
Call MCPtools/call on the bound resource
waiting
03
RevokeInvalidate before natural expiry
waiting
04
RetryRequire HTTP 401 + auth error
waiting

Short-lived MCP credentialwaiting

not issued

Resource: https://mcp.example.com/mcp
Scope: tools:call
Lifetime: 15s requested

Now run the real identity path

Move from simulation to GitHub.

The repository workflow asks GitHub for a real OIDC assertion. Its broker and MCP server are disposable runner-local fixtures, and its proof artifact contains no assertion or access token.

Run on GitHub Read the workflow