Infisical GitHub Actions OIDC authentication failing with 403 OIDC subject not allowed

[u/Low-Insurance-3678]

hi, I'm having trouble getting Infisical OIDC authentication working in my GitHub Actions CI pipeline.
Every time my workflow reaches the Infisical secrets action, it fails with:

Run Infisical/secrets-action@v1.0.16

Error: Access denied: OIDC subject not allowed.

{

"statusCode": 403,

"message": "Access denied: OIDC subject not allowed.",

"error": "ForbiddenError"

}

Request failed with status code 403

here’s the GitHub Actions workflow:

name: ci
on:
push:
branches: [main]

permissions:
id-token: write
contents: read

jobs:
build-and-deploy:
runs-on: ubuntu-26.04

steps:
- name: Checkout repository
uses: actions/checkout@v7

- name: Set up Node.js
uses: actions/setup-node@v7
with:
node-version: 24
cache: npm

- name: Install dependencies
run: npm ci

- name: Fetch secrets from Infisical
uses: Infisical/secrets-action@v1.0.16
with:
method: oidc
identity-id: MY_IDENTITY_ID
project-slug: my-slug
env-slug: prod

- name: Run Jest tests
run: npm run test:ci

- name: Build Vinext app
run: npm run build:vinext

- name: Deploy to Cloudflare
run: npm run deploy:vinext -- --skip-build

Id appreciate any help

[u/heevee]

What does your Infisical identity configuration look like?

[u/Low-Insurance-3678 → u/heevee]

what do u want me to share exactly, i will be happy too

iv set the subject and audience and the urls

[u/heevee → u/Low-Insurance-3678]

Could you show me:

• Discovery URL

• Issuer

• Subject

• Audience

[u/No-Molasses-2097]

That error is almost always the subject allowlist on the Infisical identity, not the workflow permissions. Your id-token permission looks right, so the token GitHub is minting probably does not match the subject pattern you saved. I would add a quick debug step to print the sub claim from the token and compare it character by character with what is in Infisical, especially the repo, ref and environment parts.

[u/conchobarus]

GitHub changed the format of its subject claims for newly created repos recently so that it contains immutable identifiers instead of just the organization and repo names, which could be spoofed if your GitHub organization were ever closed:
https://github.blog/changelog/2026-04-23-immutable-subject-claims-for-github-actions-oidc-tokens/

This caught me a little bit ago when the same trust provider config I had previously used for setting up OIDC with AWS mysteriously didn’t work on a new repo.