Custom OIDC Token Audiences
By Steven Van ·
A new token exchange service lets Vercel deployments mint OIDC tokens scoped to a specific downstream service, like AWS's STS.
Vercel's OIDC issuer (oidc.vercel.com) now supports custom audiences. Deployments can request an OIDC token scoped to a specific downstream service instead of the fixed https://vercel.com/{owner} audience every token carried before. Using a unique audience per provider is a security best practice: if one provider is compromised, an attacker can't replay the token against another, since the mismatched aud claim fails verification there.
A new token exchange service handles this without extra infrastructure. It takes the token a deployment already receives and returns a new one signed with the same key but a different audience, for example sts.amazonaws.com for AWS access via the @vercel/oidc-aws-credentials-provider package. The exchanged token:
- Preserves the original claims: project, environment, owner and expiration
- Sets the issuer to https://oidc.vercel.com/{owner}, scoped to the team that owns the deployment
- Adds an act (actor) claim recording the original token's audience and issued-at time, for an auditable delegation chain
- Updates the aud to the requested downstream audience and the iat to the exchange time
A jti can optionally be set on the exchanged token to trace a specific exchange through downstream logs. Downstream services verify the token against the public key at https://oidc.vercel.com/{owner}/.well-known/jwks; both the signing key and the exchange endpoint are replicated across all Vercel regions.