Orbs can now authenticate using OIDC, allowing secure access to external services without injecting secrets. Amp generates identity tokens with custom claims including workspace ID, project ID, user ID, thread ID, and email. You can configure GCP, Tailscale, AWS KMS, and other OIDC-compatible providers to trust orb identities and grant scoped permissions. All operations are auditable and use short-lived tokens tied to specific tasks.