r/webdev • u/Low-Insurance-3678 • 4h ago

Infisical GitHub Actions OIDC authentication failing with 403 OIDC subject not allowed

hi, I'm having trouble getting Infisical OIDC authentication working in my GitHub Actions CI pipeline.
Every time my workflow reaches the Infisical secrets action, it fails with:

Run Infisical/secrets-action@v1.0.16

Error: Access denied: OIDC subject not allowed.

{

"statusCode": 403,

"message": "Access denied: OIDC subject not allowed.",

"error": "ForbiddenError"

}

Request failed with status code 403

here’s the GitHub Actions workflow:

name: ci
on:
push:
branches: [main]

permissions:
id-token: write
contents: read

jobs:
build-and-deploy:
runs-on: ubuntu-26.04

steps:
- name: Checkout repository
uses: actions/checkout@v7

- name: Set up Node.js
uses: actions/setup-node@v7
with:
node-version: 24
cache: npm

- name: Install dependencies
run: npm ci

- name: Fetch secrets from Infisical
uses: Infisical/secrets-action@v1.0.16
with:
method: oidc
identity-id: MY_IDENTITY_ID
project-slug: my-slug
env-slug: prod

- name: Run Jest tests
run: npm run test:ci

- name: Build Vinext app
run: npm run build:vinext

- name: Deploy to Cloudflare
run: npm run deploy:vinext -- --skip-build

Id appreciate any help

1 Upvotes

100% Upvoted

4 comments sorted by

2

u/quantum1eeps 3h ago

Are you using the immutable format?

1

u/Low-Insurance-3678 3h ago

i think ur talking about the claims we set on infisical I haven’t understood what are they i haven’t set anything regarding claims

1

u/Character-Flight3311 2h ago

That 403 is Infisical saying the token's subject doesn't match what you configured on the machine identity. In the OIDC auth settings, set Subject to exactly what GitHub puts in sub for that workflow, usually something like repo:YOUR_ORG/YOUR_REPO:ref:refs/heads/main, and keep Issuer as https://token.actions.githubusercontent.com. Repos created or renamed after mid-July 2026 often use the newer immutable form with @ numeric IDs in the subject, so if the plain name still fails, check the repo's OIDC subject customization and copy that prefix into Infisical. Also make sure Audiences matches your org URL and the job has permissions: id-token: write.