---
title: "CLI v1.19.0: Authenticate automatically with OIDC and Docker credential discovery"
description: "The Cloudsmith CLI now eliminates the need for static API keys in CI/CD pipelines by automatically discovering OpenID Connect (OIDC) credentials for all major CI/CD platforms and includes a Docker credential helper to automatically authenticate to Cloudsmith registries."
canonical_url: "https://cloudsmith.com/changelog/cli-v1-19-0-authenticate-automatically-with-oidc-and-docker-credential-discovery"
last_updated: "2026-07-23T15:37:48.334Z"
---
# CLI v1.19.0: Authenticate automatically with OIDC and Docker credential discovery

The Cloudsmith CLI now eliminates the need for static API keys in CI/CD pipelines by automatically discovering OpenID Connect (OIDC) credentials for all major CI/CD platforms and includes a Docker credential helper to automatically authenticate to Cloudsmith registries.

## Automatic discovery of OIDC credentials

Static, long-lived API keys in CI/CD pipelines are a security liability and an operational burden: they need to be created, distributed as secrets, rotated, and revoked.



v1.18.0 introduced automatic OIDC credential discovery for AWS. v1.19.0 extends it to every major CI/CD platform, so pipelines can exchange their native workload identity token for a short-lived Cloudsmith token with zero stored secrets.

### How it works

Set `CLOUDSMITH_ORG` and `CLOUDSMITH_SERVICE_SLUG` in the pipeline, and the CLI does the rest: it detects which CI environment it’s running in, obtains the platform's native OIDC token, and exchanges it with Cloudsmith for a short-lived access token.



No API key is ever stored.



Supported services:

- **AWS**
- **GitHub Actions**
- **GitLab CI**
- **Bitbucket Pipelines**
- **CircleCI**
- **Azure DevOps**
- **Generic fallback**

All detectors work out of the box with no additional Python dependencies. For fine-grained control, individual detectors can be disabled and the detection order overridden via environment variables, CLI options, or `config.ini`.



For details, see [Automatically discover OIDC credentials](https://docs.cloudsmith.com/developer-tools/cli#automatically-discover-oidc-credentials).

## Docker credential helper

With the credential helper, Docker can automatically discover credentials from the CLI, including for custom registry domains. Previously, authenticating Docker against Cloudsmith registries required manual `docker login` with an API key per registry domain.

### How it works

Running `cloudsmith credential-helper install docker` installs a `docker-credential-cloudsmith` binary and registers it in `~/.docker/config.json` for Cloudsmith registry domains. Custom domains are discovered automatically via the Cloudsmith API and cached.



After installing the helper, `docker pull` and `docker push` against Cloudsmith registries authenticate with the CLI's existing credentials with no docker login.



For details, see [Automatically discover Docker credentials](https://docs.cloudsmith.com/developer-tools/cli#automatically-discover-docker-credentials).

## Docker image updates

- The official Docker image now runs as a non-root user
- Vulnerable dependencies have been upgraded, resolving all open Dependabot alerts
- A packaging fix ensures zipapp (.pyz) builds start correctly on macOS

For a full summary of changes, please visit the [GitHub changelog](https://github.com/cloudsmith-io/cloudsmith-cli/blob/master/CHANGELOG.md).