Skip to main content
Claude Code GitHub Actions calls the Claude API by default. To route inference through your own cloud account instead, set the Claude Code GitHub Action’s provider input and configure your cloud to trust the workflow’s OpenID Connect (OIDC) token. The workflow authenticates with that token, so you store no long-lived cloud credential in your repository.
This page builds on the GitHub Actions setup. It assumes you already know the workflow file and the anthropics/claude-code-action step, and covers only what a cloud provider changes.

​
Choose your provider

The Claude Code GitHub Action supports three providers, and the setup steps below differ only in the cloud-side configuration. Use the one where your organization already has Claude model access. You tell the Claude Code GitHub Action which provider to use with one input in the anthropics/claude-code-action step’s with: block:
  • Amazon Bedrock: use_bedrock: "true"
  • Google Cloud’s Agent Platform: use_vertex: "true"
  • Microsoft Foundry: use_foundry: "true"
The following snippet shows the input in place for Amazon Bedrock. You don’t need to edit a workflow yet, because the complete workflow examples later on this page already include the input for each provider.

​
Prerequisites

Before you start, you need:
  • Admin access to the repository where the Claude Code GitHub Action runs, to install a GitHub App and add secrets
  • Permission to create identity resources in your cloud account: IAM roles and OIDC identity providers on AWS, Workload Identity Federation resources and service accounts on Google Cloud, or Microsoft Entra applications on Azure
  • Claude model access on your provider:

​
Set up the integration

Beyond the prerequisites, you create four things: a GitHub identity for the Claude Code GitHub Action, the cloud-side trust configuration, the repository secrets, and the workflow file. The steps below walk through each.
1

Choose a GitHub identity

The Claude Code GitHub Action pushes commits and posts comments through a GitHub identity. The quick setup installs the official Claude GitHub App for this. With a cloud provider, you choose the identity yourself:
  • Official Claude GitHub App: install it on the repository, or skip to the next step if it’s already installed
  • Custom GitHub App: create your own app, described below, when you want only the three permissions the Claude Code GitHub Action uses rather than the official app’s full set
  • GitHub’s automatic GITHUB_TOKEN: no app to create or install, but GitHub doesn’t trigger your CI workflows on commits made with it
The workflow examples in the fourth step authenticate with a custom app. That step also says what to change for the other two options.To create a custom app, register a new GitHub App with webhooks disabled, since this integration doesn’t use them. Grant it three repository permissions:
  • Contents: read and write
  • Issues: read and write
  • Pull requests: read and write
After registering the app, generate a private key and keep the downloaded .pem file, note the App ID from the app’s settings page, and install the app on the repository where the Claude Code GitHub Action runs. You add the key and the ID as secrets in the third step.
2

Configure cloud authentication

Configure your cloud to trust the OIDC token that GitHub issues to the workflow, so each workflow run gets short-lived cloud credentials. The bullets in each tab summarize what to create, and each tab links the cloud vendor’s own guide for the console-level steps.
Create the trust configuration in your AWS account, following the AWS guide to creating OIDC identity providers:
  • Add a GitHub OIDC identity provider with provider URL https://token.actions.githubusercontent.com and audience sts.amazonaws.com
  • Create an IAM role trusted by that provider as a web identity, and attach the scoped invocation policy from IAM configuration, which grants bedrock:InvokeModel,