--- title: Authenticating TeamCity Builds to External Services With... description: JetBrains introduces a new OIDC JWT plugin for TeamCity that lets build configurations authenticate to external services like AWS and Google Cloud using... canonical: https://daily.dev/posts/authenticating-teamcity-builds-to-external-services-with-oidc-rd1l1m8ya twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Authenticating TeamCity Builds to External Services With OIDC | daily.dev og:description: JetBrains introduces a new OIDC JWT plugin for TeamCity that lets build configurations authenticate to external services like AWS and Google Cloud using... og:url: https://daily.dev/posts/authenticating-teamcity-builds-to-external-services-with-oidc-rd1l1m8ya og:image: https://api.daily.dev/og/posts/rD1l1M8ya.png og:image:alt: Authenticating TeamCity Builds to External Services With OIDC og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Authenticating TeamCity Builds to External Services With OIDC **[JetBrains](https://daily.dev/sources/jetbrains)** · 5 min read · 0 upvotes · 0 comments ## Summary JetBrains introduces a new OIDC JWT plugin for TeamCity that lets build configurations authenticate to external services like AWS and Google Cloud using short-lived OIDC identity tokens instead of static credentials. The plugin turns the TeamCity server into an identity provider, issuing signed JWTs (RSA or ECDSA), exposing the standard .well-known/openid-configuration and JWKS endpoints, supporting key rotation, and allowing extensibility for HSMs or key management services via a signer API. Two build features are provided: one that issues a token at build start (lifetime defaults to build timeout or 10 minutes), and an on-demand HTTP-based feature for short-lived 5-minute tokens during long-running builds. The plugin requires Java 17 and TeamCity 2025.11 or later, and is available from JetBrains Marketplace with setup guides for AWS and Google Cloud. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I authenticate TeamCity builds to AWS or Google Cloud without storing static credentials? TeamCity's new OIDC JWT plugin lets the TeamCity server act as an identity provider and issue short-lived signed JWTs that AWS, Google Cloud, or other OIDC-compatible services can validate and exchange for temporary credentials. Tokens are signed with RSA or ECDSA, and the plugin exposes the .well-known/openid-configuration and JWKS endpoints needed for verification. It requires Java 17 and TeamCity 2025.11 or later. _daily.dev surfaces plugin releases like this for teams moving off static CI/CD credentials._ ### What is the token lifetime for TeamCity's on-demand OIDC token build feature? Tokens issued through the OIDC Token (on demand via HTTP request) build feature always have a fixed 5-minute lifetime that cannot be changed. This differs from the OIDC Token (in build parameters) feature, whose token lifetime is configurable and defaults to the build timeout, or 10 minutes if no timeout is set, making the on-demand option better suited for long-running builds needing freshly minted short-lived tokens. _Engineers tuning CI token lifetimes can track plugin specifics like this on daily.dev._ ### What are the requirements to install the TeamCity OIDC JWT plugin? The plugin requires Java 17 and supports TeamCity 2025.11 and later versions. It's installed from JetBrains Marketplace and configured through Admin | Integrations | OIDC Tokens, where you set the issuer URL, signing settings, and manage signing keys. JetBrains recommends configuring the plugin before setting up OIDC for builds, since later configuration changes can disrupt existing integrations. _Teams planning CI/CD upgrades can keep tabs on plugin compatibility requirements via daily.dev._ ## Similar posts on daily.dev - [Stop Pasting Tokens: OAuth2 Login for JetBrains IDE Plugins](https://daily.dev/posts/stop-pasting-tokens-oauth2-login-for-jetbrains-ide-plugins-fttse9vi1) · JetBrains · 0 upvotes · 0 comments - [AWS Image Builder Plugin for TeamCity](https://daily.dev/posts/aws-image-builder-plugin-for-teamcity-p0qtgtsdv) · JetBrains · 0 upvotes · 0 comments - [Achieve Effortless GitHub Releases With a New Plugin for TeamCity](https://daily.dev/posts/achieve-effortless-github-releases-with-a-new-plugin-for-teamcity-sojihs0u0) · JetBrains · 1 upvotes · 0 comments - [JWTs for AI Agents: Authenticating Non-Human Identities](https://daily.dev/posts/jwts-for-ai-agents-authenticating-non-human-identities-63fw1b4g5) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#cicd](https://daily.dev/tags/cicd), [#authentication](https://daily.dev/tags/authentication) [View this post on daily.dev](https://daily.dev/posts/authenticating-teamcity-builds-to-external-services-with-oidc-rd1l1m8ya) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Authenticating TeamCity Builds to External Services With OIDC","url":"https://daily.dev/posts/authenticating-teamcity-builds-to-external-services-with-oidc-rd1l1m8ya","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/authenticating-teamcity-builds-to-external-services-with-oidc-rd1l1m8ya"},"datePublished":"2026-09-01T07:27:27.906Z","dateModified":"2026-09-01T07:36:12.797Z","description":"JetBrains introduces a new OIDC JWT plugin for TeamCity that lets build configurations authenticate to external services like AWS and Google Cloud using...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f4eff2a4474747cbb1470b39bfebb026?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f4eff2a4474747cbb1470b39bfebb026?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"JetBrains","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"JetBrains","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/53ecf0c676f34b3896ee109609d91efa","url":"https://daily.dev/sources/jetbrains"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/authenticating-teamcity-builds-to-external-services-with-oidc-rd1l1m8ya","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws,cicd,authentication","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"JetBrains","item":"https://daily.dev/sources/jetbrains"},{"@type":"ListItem","position":3,"name":"Authenticating TeamCity Builds to External Services With OIDC"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/authenticating-teamcity-builds-to-external-services-with-oidc-rd1l1m8ya#faq","mainEntity":[{"@type":"Question","name":"How can I authenticate TeamCity builds to AWS or Google Cloud without storing static credentials?","acceptedAnswer":{"@type":"Answer","text":"TeamCity's new OIDC JWT plugin lets the TeamCity server act as an identity provider and issue short-lived signed JWTs that AWS, Google Cloud, or other OIDC-compatible services can validate and exchange for temporary credentials. Tokens are signed with RSA or ECDSA, and the plugin exposes the .well-known/openid-configuration and JWKS endpoints needed for verification. It requires Java 17 and TeamCity 2025.11 or later. daily.dev surfaces plugin releases like this for teams moving off static CI/CD credentials."}},{"@type":"Question","name":"What is the token lifetime for TeamCity's on-demand OIDC token build feature?","acceptedAnswer":{"@type":"Answer","text":"Tokens issued through the OIDC Token (on demand via HTTP request) build feature always have a fixed 5-minute lifetime that cannot be changed. This differs from the OIDC Token (in build parameters) feature, whose token lifetime is configurable and defaults to the build timeout, or 10 minutes if no timeout is set, making the on-demand option better suited for long-running builds needing freshly minted short-lived tokens. Engineers tuning CI token lifetimes can track plugin specifics like this on daily.dev."}},{"@type":"Question","name":"What are the requirements to install the TeamCity OIDC JWT plugin?","acceptedAnswer":{"@type":"Answer","text":"The plugin requires Java 17 and supports TeamCity 2025.11 and later versions. It's installed from JetBrains Marketplace and configured through Admin | Integrations | OIDC Tokens, where you set the issuer URL, signing settings, and manage signing keys. JetBrains recommends configuring the plugin before setting up OIDC for builds, since later configuration changes can disrupt existing integrations. Teams planning CI/CD upgrades can keep tabs on plugin compatibility requirements via daily.dev."}}]} ```