Support Workload Identity Federation (OIDC) for resource authentication

💬 Feature Requests
1

Currently, connecting Retool to GCP services like Google Drive requires either a service account JSON key or OAuth 2.0 (which ties to a human identity). Both have significant downsides: keys are long-lived secrets that need manual rotation, and OAuth shared credentials break if the authorizing user leaves.

GCP Workload Identity Federation lets external platforms authenticate using short-lived OIDC tokens with zero stored secrets. GitHub Actions, GKE, and most major CI/CD platforms already support this. Adding WIF support for Retool resource authentication would eliminate key management entirely and align with zero-trust security practices.

Ideal implementation: when configuring a GCP resource in Retool, allow specifying a Workload Identity Pool + Provider instead of a key file, so Retool presents its own OIDC token to GCP and receives short-lived access tokens automatically.

1 Like
4

Hey @BrettMoan thanks for waiting! I've filed a feature request with our team. We'll update this thread if there's progress to share. :+1:

1 Like
5

ChiEn,

Thanks for your reply!

Please don’t hesitate to reach out for a back and forth on how we might implement this including potentially including as beta-capability while you iron out the details for UI etc.

At the end of the day, its a feature I’d appreciate, and would make my life easier (because i won’t have to do credential rotations), but I know you’ll have to think a out how this features displays in the UI, and in help docs before you broadly advertise the capability.

6

Hey @BrettMoan, really appreciate the offer, and good to know you'd be open to a beta. I've passed that along internally. Will keep you posted here as things develop! :smiley: