Anthropic 平台文档（英文全量）

SPIFFE is the CNCF standard for issuing identity to workloads. SPIRE is its open-source reference implementation, and several commercial products also issue SPIFFE-conformant identities. Anthropic federates with any SPIFFE implementation that emits OIDC-compatible JWT-SVIDs. For a current list of implementations, see Commercial software that implements SPIFFE on the SPIFFE project site.

Federation works either through an OIDC discovery document at a public HTTPS URL (discovery mode, subject to the URL constraints) or by registering the JWKS directly (inline mode).

The JWT-SVID spec defines sub as the workload's SPIFFE ID, and the SPIFFE Workload API requires the caller to supply aud at fetch time, so those claims are the same across implementations. Anthropic additionally requires iss and iat, neither of which the JWT-SVID spec mandates, so configure your implementation to populate both (in SPIRE, iss is the jwt_issuer server setting and iat is set automatically). With those in place, the Configure Anthropic, Acquire and use the token, and Scope your rule sections of this guide apply to any SPIFFE implementation.