Both OIDC federation and IAM Roles Anywhere eliminate long-lived AWS keys. credctl chose OIDC — for multi-cloud portability and zero customer-side PKI. Here’s the reasoning, and the cases where Roles Anywhere is genuinely the better answer.
credctl is adding a team broker, and v1 is deliberately a registry, not a credential proxy — out of the issuance path entirely. Here’s the design, the trade-off it accepts, and the three questions we want pushback on before we build.
Long-lived access keys are the COBOL of cloud authentication — they predate the tools that replaced them and survive on inertia. Here’s why the next five years end them, and what’s arriving in their place.
Granted is best-in-class for AWS SSO role switching and browser-console isolation. credctl replaces long-lived keys with hardware-bound OIDC federation. They address overlapping but distinct pain points.
Vault is a centralised secrets manager for teams and services. credctl replaces the long-lived AWS keys on your laptop with hardware-bound credentials. They solve different problems — and often work well together.
aws-vault keeps your long-lived AWS keys encrypted in the OS keychain and hands out short-lived STS sessions. credctl replaces the long-lived keys entirely with hardware-bound OIDC federation. Here’s an honest comparison.
One OAuth token at a third-party AI vendor turned into ‘rotate all your secrets’ for a subset of Vercel customers. The blast radius wasn’t an accident of this breach — it’s the default for extractable, long-lived credentials.
credctl auth –provider gcp exchanges the same hardware-bound JWT for short-lived GCP access tokens via Workload Identity Federation. Same Secure Enclave key. Same OIDC provider. No new infrastructure.
86% of breaches involve stolen credentials. Your AWS keys sit in plaintext on disk. The Secure Enclave can fix this — credctl connects the pieces.
A technical walkthrough of credctl’s architecture — from Secure Enclave key generation through cgo, JWT construction, and OIDC federation with AWS STS.
