product · May 20, 2026
Buildkite Releases OAuth Token Exchange for Short-Lived API Tokens
Share the canonical public link.
Buildkite launched OAuth 2.0 Token Exchange (RFC 8693) on May 13, 2026 allowing identity providers to mint short-lived scoped Buildkite API tokens from signed JWTs. Users avoid storing or rotating long-lived secrets with the new three-step process using keypairs or JWKS. The feature includes IP restrictions, audit logging, and per-user rate limiting for the Buildkite REST and GraphQL APIs. Buildkite previously added per-user rate limits on April 29, 2026.
Below validation threshold — auto-passed without scoring