Security, Trust & ComplianceConference50min
Say Goodbye to LLM API keys with Workload Identity Federation
The session explains why API keys are unsafe for production LLM access and how Workload Identity Federation replaces them with short-lived tokens. It covers SPIFFE and Kubernetes service tokens as workload identities, then demonstrates a Quarkus LangChain4j app using SPIFFE-issued JWTs with Anthropic WIF.
talk.summaryAiDisclaimer
Siarhei BiarozkinIBM / Red Hat
Using API keys to access LLM models offers an easy and fast way to get started with AI development work. But using API keys in production is an anti-pattern - they do not represent an agent identity, are not cryptographically secure, not easy to refresh while easy enough to leak and can remain active long after someone who allocated them left.
Workload Identity Federation (WIF) is a mechanism that can help migrate from API keys to short term access tokens that an AI agent can acquire in exchange for its workload identity token. With Anthropic, OpenAI and other LLM providers moving away from API keys and offering top-class Workload Identity Federation integration, it is the right time to learn about WIF.
In this session we will learn how SPIFFE (Secure Production Identity Framework for Everyone) and Kubernetes service tokens can be used as verifiable workload identifies for either multi-cluster or single cluster deployments.
We will finish with a demo that shows a Quarkus LangChain4j application that uses a SPIFFE provisioned JWT workload identity token to integrate with Anthropic Workload Identity Federation for a secure LLM access.
Workload Identity Federation (WIF) is a mechanism that can help migrate from API keys to short term access tokens that an AI agent can acquire in exchange for its workload identity token. With Anthropic, OpenAI and other LLM providers moving away from API keys and offering top-class Workload Identity Federation integration, it is the right time to learn about WIF.
In this session we will learn how SPIFFE (Secure Production Identity Framework for Everyone) and Kubernetes service tokens can be used as verifiable workload identifies for either multi-cluster or single cluster deployments.
We will finish with a demo that shows a Quarkus LangChain4j application that uses a SPIFFE provisioned JWT workload identity token to integrate with Anthropic Workload Identity Federation for a secure LLM access.
Siarhei Biarozkin
Sergey Beryozkin is a member of the Quarkus Security team where he focuses on OpenId Connect, Workload Identity and MCP security. He was an Apache Software Foundation (ASF) CXF JAX-RS (Java API for RESTful Web Services) implementation and security support project lead for many years. He is interested in how distributed systems can interoperate at scale and still remembers about Corba. He has lived in Dublin, Ireland for more than a quarter of a century, is an aspiring cyclist, a keen walker and club chess player.