Identity, not secrets
An SVID, not an API key
Each workload presents a short-lived, signed SVID instead of a shared secret, so there is nothing long-lived to leak or rotate by hand.
Features / Workload identity
Cryptographic identity for every workload.
Services, jobs and agents have to prove who they are to each other, and sharing an API key or a long-lived secret to do it is the weak link. With SPIFFE, each workload gets a short-lived, cryptographically verifiable identity instead of a secret. WebFrolic issues these identities, so your workloads authenticate by what they are, not by a secret they hold.
SPIFFE-based. No shared secrets.
Why it matters
Shared secrets are the service-to-service weak link.
A copied API key works for anyone who holds it. A workload identity does not.
Named and scoped
A SPIFFE ID per workload
Every workload has its own spiffe:// identity in your trust domain, so service-to-service calls are attributable.
Standards-based
SPIFFE / SPIRE
Works with the SPIFFE ecosystem and its tooling, using JWT SVIDs, rather than a proprietary scheme.
The building blocks
From shared secrets to workload identity.
Naming
SPIFFE IDs
A spiffe:// identity per workload, scoped to your trust domain, so every service has a name you can reason about.
Explore ↗Credentials
JWT SVIDs
Short-lived tokens a workload presents to prove its identity, issued and rotated automatically.
Explore ↗Boundaries
Trust domain and federation
One trust domain for your workloads, with federation to others when services span organizations or clouds.
Explore ↗Together
Off shared secrets
Pairs with the vault and service and machine users to move service-to-service auth off long-lived secrets.
Explore ↗How it works
Register, attest, present, rotate.
Register
Define the workload and the SPIFFE ID it should have in your trust domain.
Attest
The workload proves what it is, and WebFrolic issues its SVID.
Present
The workload uses its SVID to authenticate to peers and to your APIs.
Rotate
SVIDs are short-lived and rotate automatically — there is nothing long-lived to manage.
Before rollout
Questions worth answering.
Settle these and the rest is configuration.
- Map which workloads need identity: services, jobs, agents, batch tasks.
- Define your trust domain and how SPIFFE IDs are named.
- Decide how workloads consume SVIDs: a sidecar, an SDK, or an API.
- Decide whether you need federation with other trust domains.
Related capabilities
Explore what connects to this.
Workload identity sits alongside the rest of your non-human identities.
Evaluate with your scenario
Start with two services that share a secret.
Tell us a pair of workloads that authenticate with a shared key today. A walkthrough can show them moving to SPIFFE identities instead.