@@ -133,3 +133,12 @@ Using this flow is less secure since the token is long-lived. You can provide th
    ```
 
    When running in Azure DevOps with the [STACKIT Service Connection](https://marketplace.visualstudio.com/items?itemName=SchwarzDigits.stackit-service-connection), the CLI reads `STACKIT_SERVICE_CONNECTION_ID` and requests the OIDC token for that service connection.
+
+3. Activate the service account and run commands as usual:
+
+   ```bash
+   stackit auth activate-service-account --use-oidc
+   stackit project list
+   ```
+
+   As with a service account key, the following commands use the activated service account. Only the service account email is stored: the OIDC token is read from the environment every time a new access token is needed, so the token source must still be available when running those commands (e.g. in the same CI job).
@@ -165,6 +165,11 @@ func runOIDCMode(params *types.CmdParams, model *inputModel) error {
 	}
 
 	tokenCustomEndpoint := viper.GetString(config.TokenCustomEndpointKey)
+	if !model.OnlyPrintAccessToken {
+		if err := storeCustomEndpoint(tokenCustomEndpoint); err != nil {
+			return err
+		}
+	}
 
 	wifCfg := &sdkConfig.Configuration{
 		WorkloadIdentityFederation:       true,
@@ -179,8 +184,8 @@ func runOIDCMode(params *types.CmdParams, model *inputModel) error {
 		return &cliErr.ActivateServiceAccountError{}
 	}
 
-	// credentials are never written to disk in OIDC mode
-	saEmail, accessToken, err := auth.AuthenticateServiceAccount(params.Printer, rt, true)
+	// only the service account email is stored, the federated token is read from the environment on every command
+	saEmail, accessToken, err := auth.AuthenticateServiceAccount(params.Printer, rt, model.OnlyPrintAccessToken)
 	if err != nil {
 		var activateErr *cliErr.ActivateServiceAccountError
 		if !errors.As(err, &activateErr) {
 
@@ -100,6 +100,16 @@ func AuthenticationConfig(p *print.Printer, reauthorizeUserRoutine func(p *print
 			return nil, fmt.Errorf("initialize service account key flow: %w", err)
 		}
 		authCfgOption = sdkConfig.WithCustomAuth(keyFlow)
+	case AUTH_FLOW_WORKLOAD_IDENTITY:
+		p.Debug(print.DebugLevel, "authenticating using workload identity federation")
+		if userSessionExpired {
+			return nil, fmt.Errorf("session expired")
+		}
+		wifFlow, err := initWIFFlowWithStorage()
+		if err != nil {
+			return nil, fmt.Errorf("initialize workload identity federation flow: %w", err)
+		}
+		authCfgOption = sdkConfig.WithCustomAuth(wifFlow)
 	case AUTH_FLOW_USER_TOKEN:
 		p.Debug(print.DebugLevel, "authenticating using user token")
 		if userSessionExpired {
@@ -195,6 +205,15 @@ func GetValidAccessToken(p *print.Printer) (string, error) {
 		return GetAccessToken()
 	}
 
+	// For workload identity federation, request a new token if the stored one expired
+	if flow == AUTH_FLOW_WORKLOAD_IDENTITY {
+		wifFlow, err := initWIFFlowWithStorage()
+		if err != nil {
+			return "", fmt.Errorf("initialize workload identity federation flow: %w", err)
+		}
+		return wifFlow.GetAccessToken()
+	}
+
 	if flow != AUTH_FLOW_USER_TOKEN {
 		return "", fmt.Errorf("unsupported authentication flow: %s", flow)
 	}
 
@@ -74,6 +74,8 @@ func TestAuthenticationConfig(t *testing.T) {
 		saKey                         string
 		privateKeySet                 bool
 		tokenEndpoint                 string
+		saEmail                       string
+		federatedToken                string
 		isValid                       bool
 		expectedCustomAuthSet         bool
 		expectedTokenSet              bool
@@ -119,6 +121,41 @@ func TestAuthenticationConfig(t *testing.T) {
 			tokenEndpoint:    "token_url",
 			isValid:          false,
 		},
+		{
+			description:           "base_workload_identity",
+			flow:                  AUTH_FLOW_WORKLOAD_IDENTITY,
+			sessionExpiresAt:      time.Now().Add(time.Hour),
+			accessTokenSet:        true,
+			saEmail:               "ci@sa.stackit.cloud",
+			federatedToken:        "federated_token",
+			isValid:               true,
+			expectedCustomAuthSet: true,
+		},
+		{
+			description:      "workload_identity_session_expired",
+			flow:             AUTH_FLOW_WORKLOAD_IDENTITY,
+			sessionExpiresAt: time.Now().Add(-time.Hour),
+			accessTokenSet:   true,
+			saEmail:          "ci@sa.stackit.cloud",
+			federatedToken:   "federated_token",
+			isValid:          false,
+		},
+		{
+			description:      "workload_identity_no_federated_token_source",
+			flow:             AUTH_FLOW_WORKLOAD_IDENTITY,
+			sessionExpiresAt: time.Now().Add(time.Hour),
+			accessTokenSet:   true,
+			saEmail:          "ci@sa.stackit.cloud",
+			isValid:          false,
+		},
+		{
+			description:      "workload_identity_no_email",
+			flow:             AUTH_FLOW_WORKLOAD_IDENTITY,
+			sessionExpiresAt: time.Now().Add(time.Hour),
+			accessTokenSet:   true,
+			federatedToken:   "federated_token",
+			isValid:          false,
+		},
 		{
 			description:      "base_user_token",
 			flow:             AUTH_FLOW_USER_TOKEN,
@@ -156,6 +193,13 @@ func TestAuthenticationConfig(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.description, func(t *testing.T) {
 			t.Setenv(EnvUseOIDC, "") // ensure OIDC mode is off for these tests
+			// only the static federated token is used as OIDC token source in these tests
+			t.Setenv(EnvServiceAccountFederatedToken, tt.federatedToken)
+			t.Setenv(EnvFederatedTokenFile, "")
+			t.Setenv(EnvGitHubRequestURL, "")
+			t.Setenv(EnvGitHubRequestToken, "")
+			t.Setenv(EnvAzureOIDCRequestURI, "")
+			t.Setenv(EnvAzureAccessToken, "")
 			keyring.MockInit()
 			timestamp := time.Now().Add(24 * time.Hour)
 			authFields := make(map[authFieldKey]string)
@@ -182,6 +226,7 @@ func TestAuthenticationConfig(t *testing.T) {
 			authFields[REFRESH_TOKEN] = tt.refreshToken
 			authFields[SERVICE_ACCOUNT_KEY] = tt.saKey
 			authFields[TOKEN_CUSTOM_ENDPOINT] = tt.tokenEndpoint
+			authFields[SERVICE_ACCOUNT_EMAIL] = tt.saEmail
 
 			err = SetAuthFlow(tt.flow)
 			if err != nil {
 
@@ -68,15 +68,17 @@ func AuthenticateServiceAccount(p *print.Printer, rt http.RoundTripper, disableW
 		authFields[ACCESS_TOKEN] = flow.GetConfig().ServiceAccountToken
 	case wifFlowInterface:
 		p.Debug(print.DebugLevel, "authenticating using workload identity federation")
-		authFlowType = AUTH_FLOW_SERVICE_ACCOUNT_KEY
+		authFlowType = AUTH_FLOW_WORKLOAD_IDENTITY
 
 		accessToken, err := flow.GetAccessToken()
 		if err != nil {
 			p.Debug(print.ErrorLevel, "get workload identity access token: %v", err)
 			return "", "", &errors.ActivateServiceAccountError{}
 		}
+		// only the service account email is stored; the federated token is read from the environment on every refresh
 		authFields[ACCESS_TOKEN] = accessToken
-		disableWriting = true
+		authFields[SERVICE_ACCOUNT_KEY] = ""
+		authFields[PRIVATE_KEY] = ""
 	default:
 		return "", "", fmt.Errorf("could not authenticate using any of the supported authentication flows (key and token): please report this issue")
 	}
@@ -149,6 +151,37 @@ func initKeyFlowWithStorage() (*keyFlowWithStorage, error) {
 	return keyFlowWithStorage, nil
 }
 
+// initWIFFlowWithStorage initializes the workload identity federation flow for the service account stored in the auth storage.
+// The federated token is not stored, it is read from the environment every time the access token is refreshed.
+func initWIFFlowWithStorage() (*clients.WorkloadIdentityFederationFlow, error) {
+	authFields := map[authFieldKey]string{
+		SERVICE_ACCOUNT_EMAIL: "",
+		TOKEN_CUSTOM_ENDPOINT: "",
+	}
+	err := GetAuthFieldMap(authFields)
+	if err != nil {
+		return nil, fmt.Errorf("get from auth storage: %w", err)
+	}
+
+	tokenFunc, err := OIDCTokenFunc()
+	if err != nil {
+		return nil, err
+	}
+
+	cfg := &clients.WorkloadIdentityFederationFlowConfig{
+		TokenUrl:               authFields[TOKEN_CUSTOM_ENDPOINT],
+		ClientID:               authFields[SERVICE_ACCOUNT_EMAIL],
+		FederatedTokenFunction: tokenFunc,
+	}
+
+	wifFlow := &clients.WorkloadIdentityFederationFlow{}
+	err = wifFlow.Init(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("initialize workload identity federation flow: %w", err)
+	}
+	return wifFlow, nil
+}
+
 // The keyFlowWithStorage Roundtrip executes the keyFlow roundtrip and then stores the access token
 func (kf *keyFlowWithStorage) RoundTrip(req *http.Request) (*http.Response, error) {
 	resp, err := kf.keyFlow.RoundTrip(req)
 
@@ -207,9 +207,15 @@ func TestAuthenticateServiceAccount_WIF(t *testing.T) {
 		isValid            bool
 	}{
 		{
-			description:    "wif_success_no_credentials_written",
+			description:    "wif_success_credentials_written",
 			accessToken:    raw,
-			disableWriting: false, // even when false, WIF forces no-write internally
+			disableWriting: false,
+			isValid:        true,
+		},
+		{
+			description:    "wif_success_writing_disabled",
+			accessToken:    raw,
+			disableWriting: true,
 			isValid:        true,
 		},
 		{
@@ -224,6 +230,17 @@ func TestAuthenticateServiceAccount_WIF(t *testing.T) {
 			keyring.MockInit()
 			config.InitConfig()
 
+			// leftovers from a previous key flow must not survive a WIF activation
+			if err := SetAuthFieldMap(map[authFieldKey]string{
+				SERVICE_ACCOUNT_KEY: "old_key",
+				PRIVATE_KEY:         "old_private_key",
+			}); err != nil {
+				t.Fatalf("set previous credentials: %v", err)
+			}
+			if err := SetAuthFlow(AUTH_FLOW_SERVICE_ACCOUNT_KEY); err != nil {
+				t.Fatalf("set previous auth flow: %v", err)
+			}
+
 			flow := &wifFlowMocked{
 				accessToken:        tt.accessToken,
 				getAccessTokenFail: tt.getAccessTokenFail,
@@ -245,16 +262,31 @@ func TestAuthenticateServiceAccount_WIF(t *testing.T) {
 				t.Fatalf("email = %q, want %q", email, testEmail)
 			}
 
-			// Verify no credentials were written to the keyring / file.
-			// After a WIF authentication, the auth storage should not contain a
-			// service account key or private key.
+			storedFlow, _ := GetAuthFlow()
+			storedEmail, _ := GetAuthField(SERVICE_ACCOUNT_EMAIL)
 			storedKey, _ := GetAuthField(SERVICE_ACCOUNT_KEY)
+			storedPrivKey, _ := GetAuthField(PRIVATE_KEY)
+
+			if tt.disableWriting {
+				if storedFlow != AUTH_FLOW_SERVICE_ACCOUNT_KEY {
+					t.Errorf("auth flow = %q, want previous flow %q untouched when writing is disabled", storedFlow, AUTH_FLOW_SERVICE_ACCOUNT_KEY)
+				}
+				return
+			}
+
+			// Only the flow and the service account email are needed to rebuild the WIF flow,
+			// the federated token is read from the environment on every command.
+			if storedFlow != AUTH_FLOW_WORKLOAD_IDENTITY {
+				t.Errorf("auth flow = %q, want %q", storedFlow, AUTH_FLOW_WORKLOAD_IDENTITY)
+			}
+			if storedEmail != testEmail {
+				t.Errorf("SERVICE_ACCOUNT_EMAIL = %q, want %q", storedEmail, testEmail)
+			}
 			if storedKey != "" {
-				t.Errorf("SERVICE_ACCOUNT_KEY was written to storage in WIF mode, want empty")
+				t.Errorf("SERVICE_ACCOUNT_KEY = %q, want empty in WIF mode", storedKey)
 			}
-			storedPrivKey, _ := GetAuthField(PRIVATE_KEY)
 			if storedPrivKey != "" {
-				t.Errorf("PRIVATE_KEY was written to storage in WIF mode, want empty")
+				t.Errorf("PRIVATE_KEY = %q, want empty in WIF mode", storedPrivKey)
 			}
 		})
 	}
 
@@ -46,6 +46,7 @@ const (
 	AUTH_FLOW_USER_TOKEN            AuthFlow     = "user_token"
 	AUTH_FLOW_SERVICE_ACCOUNT_TOKEN AuthFlow     = "sa_token"
 	AUTH_FLOW_SERVICE_ACCOUNT_KEY   AuthFlow     = "sa_key"
+	AUTH_FLOW_WORKLOAD_IDENTITY     AuthFlow     = "sa_wif"
 )
 
 // Returns all auth field keys managed by the auth storage
@@ -335,7 +336,7 @@ func GetProfileEmail(profile string) string {
 		if err != nil {
 			email = ""
 		}
-	case AUTH_FLOW_SERVICE_ACCOUNT_TOKEN, AUTH_FLOW_SERVICE_ACCOUNT_KEY:
+	case AUTH_FLOW_SERVICE_ACCOUNT_TOKEN, AUTH_FLOW_SERVICE_ACCOUNT_KEY, AUTH_FLOW_WORKLOAD_IDENTITY:
 		email, err = getAuthFieldWithProfile(profile, SERVICE_ACCOUNT_EMAIL)
 		if err != nil {
 			email = ""
 
@@ -952,6 +952,13 @@ func TestGetProfileEmail(t *testing.T) {
 			authFlow:        AUTH_FLOW_SERVICE_ACCOUNT_KEY,
 			expectedEmail:   "test@test.com",
 		},
+		{
+			description:     "default profile, workload identity",
+			activeProfile:   config.DefaultProfileName,
+			serviceAccEmail: "test@test.com",
+			authFlow:        AUTH_FLOW_WORKLOAD_IDENTITY,
+			expectedEmail:   "test@test.com",
+		},
 		{
 			description:   "custom profile, user token",
 			activeProfile: "test-profile",