RFC 7523 jwt-bearer grant for the Claude API. SPIFFE, EKS IRSA, GitHub Actions OIDC, Kubernetes projected SAs — all federate to short-lived tokens. Here's how it works, how it maps onto the IETF agentic identity blueprint, and the one trap that will cause confused deputy bugs in production.
Anthropic Just Killed the API Key: A Deep Dive into Workload Identity Federation for Claude
