# GitHub Actions: Error: Unable to get ACTIONS_ID_TOKEN_REQUEST_URL env variable

**Code:** `Unable to get ACTIONS_ID_TOKEN_REQUEST_URL` · **Category:** CI/CD · **Seen on:** GitHub Actions

A step tried to get an OIDC token (for AWS, Azure, GCP, Vault) but the job was not granted `id-token: write` permission.

## Meaning

OIDC tokens are only issued when the workflow or job sets `permissions: id-token: write`. Reusable workflows and fork pull requests may not receive the token at all. When you set `permissions` at all, unlisted permissions become `none`, so remember `contents: read` too.

## Common causes

- `permissions: id-token: write` missing at workflow or job level
- Permissions block overriding defaults without `id-token`
- Pull request from a fork (OIDC not available)
- Calling a reusable workflow without passing permissions
- Self-hosted GitHub Enterprise Server without OIDC enabled

## Quick fix

1. Add `id-token: write` (and `contents: read`) in `permissions`
2. Do not use OIDC on fork PR jobs
3. Pass permissions down when calling reusable workflows

## Detailed fix by platform

### GitHub Actions

1. Job-level: `permissions: { id-token: write, contents: read }`

## Code examples

### Permissions for OIDC

```yaml
jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      id-token: write       # required to request the OIDC token
      contents: read
    steps:
      - uses: actions/checkout@v4
```

## How to diagnose

1. **Permissions** — Is id-token: write set for this job?
2. **Source** — Fork PR?
3. **Reusable** — Passed to the called workflow?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/cicd/gha-oidc-id-token-url-missing)