# Secrets of the Orb

link · 2026-07-19

> ## Okay, but what can I actually *do* with that token?
>
> Even after building OIDC into orbs, it wasn't immediately obvious to me how far we could push an OIDC-based dev env. So here are a few ideas to get the juices flowing, drawn from both internal usage and feedback from our early partners.
>
> 1. Configure [workload identity federation](https://docs.cloud.google.com/iam/docs/workload-identity-federation) in GCP and grant access to your production logs and metrics from all orbs in your workspace.

I've been banging my head around how to give the agent the credentials necessary for whichever task it needs to do in the sandbox[^1].

[^1]: I had decided without much conviction to inject encrypted secrets and have them be decrypted on sandbox boot with the caveats that I would spend more time researching a better solution later.

[via Amp](https://ampcode.com/news/secrets-of-the-orb?utm_source=aliou.me&utm_medium=markdown)