Cosign Authentication

specification: API Commons Authentication
specificationVersion: '0.1'
provider: Cosign
providerId: cosign
generated: '2026-09-07'
method: searched
source: >-
  https://docs.sigstore.dev/cosign/signing/overview/ ;
  https://docs.sigstore.dev/cosign/key_management/overview/ ;
  https://fulcio.sigstore.dev/api/v2/configuration (probed 2026-09-07, HTTP 200)
description: >-
  Cosign has no API key and no account. Its identity model is OIDC: the signer proves who they are to
  an OIDC provider, exchanges that token at Fulcio for a short-lived X.509 code-signing certificate,
  signs, and the event is recorded in the Rekor transparency log. Everything else is a local key
  material choice — a generated key pair, a cloud KMS URI, or a hardware token — plus ordinary
  registry credentials for the OCI registry the artifact lives in.
primary_model: oidc-keyless
schemes:
  - id: keyless-oidc
    type: openIdConnect
    default: true
    description: >-
      Short-lived certificate issued by Fulcio against a verified OIDC identity. No long-lived key is
      stored. In CI the token is picked up ambiently (GitHub Actions, GitLab, CircleCI, Buildkite);
      interactively cosign opens a browser flow, and a device flow is available for headless use.
    issuer_endpoint: https://oauth2.sigstore.dev/auth
    ca_endpoint: https://fulcio.sigstore.dev
    transparency_log: https://rekor.sigstore.dev
    accepted_issuers_endpoint: https://fulcio.sigstore.dev/api/v2/configuration
    accepted_issuers_note: >-
      The live Fulcio configuration endpoint enumerates every accepted issuer with its audience,
      challenge claim and issuer type. Observed issuers on 2026-09-07 include
      https://accounts.google.com (email), https://gitlab.com and https://gitlab.archlinux.org,
      https://oidc.circleci.com, https://oidc.codefresh.io and other ci-provider entries; the
      audience is "sigstore" and the challenge claim is "sub" for CI providers and "email" for email
      identities.
    verification_flags:
      - --certificate-identity
      - --certificate-identity-regexp
      - --certificate-oidc-issuer
      - --certificate-oidc-issuer-regexp
    note: >-
      Verification of a keyless signature REQUIRES both an identity and an issuer constraint —
      cosign will not verify a keyless signature against "any identity".
  - id: local-key-pair
    type: key
    description: >-
      A password-protected ECDSA-P256 key pair generated by `cosign generate-key-pair`, or an
      existing PEM-encoded RSA/EC private key brought in with `cosign import-key-pair`. Used with
      --key on sign and verify.
    commands:
      - cosign generate-key-pair
      - cosign import-key-pair
      - cosign public-key
  - id: kms
    type: key
    description: >-
      Signing key held in a cloud or self-hosted KMS and referenced by URI, so the private key never
      leaves the KMS. KMS support is also pluggable (see the Sigstore "KMS plugins" work).
    uri_schemes:
      - awskms://
      - gcpkms://
      - azurekms://
      - hashivault://
      - k8s://
    docs: https://docs.sigstore.dev/cosign/key_management/signing_with_self-managed_keys/
  - id: hardware-token
    type: key
    description: >-
      Signing with a key resident on a PIV-capable smartcard/YubiKey or any PKCS#11 token. Includes
      PIN/PUK and management-key administration and attestation of the on-device key.
    commands:
      - cosign piv-tool
      - cosign pkcs11-tool
    docs: https://docs.sigstore.dev/cosign/key_management/hardware-based-tokens/
  - id: registry-credentials
    type: http
    scheme: basic-or-bearer
    description: >-
      Ordinary OCI registry authentication, used to read and write signatures, attestations and SBOMs
      alongside the artifact. Cosign reads the ambient Docker/containerd credential store or takes an
      explicit login.
    commands:
      - cosign login
  - id: rekor-read
    type: none
    description: >-
      Reads against the public Rekor transparency log are unauthenticated. Verified 2026-09-07:
      https://rekor.sigstore.dev/api/v1/log returned HTTP 200 with a signed tree head with no
      credential supplied.
scopes:
  applicable: false
  note: >-
    Cosign defines no OAuth scope surface of its own. The OIDC exchange requests identity claims from
    the user's own provider; there is no Cosign authorization server, no consent screen and no
    token with Cosign-defined scopes, so no scopes/ artifact is written.
secrets_handling:
  env_inspection: cosign env --show-descriptions
  sensitive_values_opt_in: cosign env --show-sensitive-values
  note: >-
    `cosign env` deliberately masks sensitive environment variable values unless the operator asks
    for them explicitly.