Platform & DevOps·Secrets, identity and the supply chain
the token the workload holds expires in fifteen minutes, so a leaked one is worth almost nothing by the time it is found.
Short-lived credential
Also calleddynamic secret, ephemeral credential, temporary token
Credentials issued on demand with a short lifetime and renewed continuously, rather than static secrets that live until someone rotates them. It converts the security question from 'has this leaked' to 'how long is the window', and it removes rotation as a scheduled human task. It requires an identity the issuer trusts, which is why it and workload identity always arrive together.