docs: add sandbox workload identity (IAM tokens) page#312
Conversation
Documents the new `iam` option on Sandbox.create and the Secret iamToken/iam_token helper from e2b-dev/E2B#1606. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
PR SummaryLow Risk Overview Reviewed by Cursor Bugbot for commit 9614e54. Bugbot is set up for automated code reviews on this repo. Configure here. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 9614e54. Configure here.
| Each token is scoped to an audience — the external service that will verify it, such as AWS STS — and the service can exchange the token for its own temporary credentials. | ||
|
|
||
| <Note> | ||
| Workload identity is currently available for selected teams. If it's not enabled for your team, sandbox creation with the `iam` option fails with `Sandbox IAM workload tokens are not available for your team.` — [contact us](/docs/support) to get access. |
There was a problem hiding this comment.
Team used instead of project
Medium Severity
Prose uses "teams" / "your team" for the E2B organizational unit; user-facing docs use "project". The quoted API error string can keep "team".
Triggered by learned rule: Use "project" not "team" for the organizational concept — but keep API identifiers unchanged
Reviewed by Cursor Bugbot for commit 9614e54. Configure here.
|
Preview deployment for your docs. Learn more about Mintlify Previews.
|
1 participant
Documents the sandbox workload identity feature from e2b-dev/E2B#1606. Adds a new Workload identity page to the Sandbox group covering the
iamoption onSandbox.create, theSecret.iamToken/Secret.iam_tokenhelper, and the plain-object token form, with JS and Python examples. Also documents backend constraints verified in the infra code:JWT-SVIDas the only supported token type, requiredaudience, non-empty token names, a 5-token limit, and the per-team gating error. Runtime token delivery is intentionally not documented — it isn't implemented in the public spec yet.🤖 Generated with Claude Code