# Custom OIDC Token Audiences

By Steven Van · 2026-06-23

A new token exchange service lets Vercel deployments mint OIDC tokens scoped to a specific downstream service, like AWS's STS.

[Vercel](<https://creatorstoolbox.com/tools/vercel>)'s OIDC issuer (oidc.vercel.com) now supports custom audiences. Deployments can request an OIDC token scoped to a specific downstream service instead of the fixed *https://vercel.com/{owner}* audience every token carried before. Using a unique audience per provider is a security best practice: if one provider is compromised, an attacker can't replay the token against another, since the mismatched *aud* claim fails verification there.

A new [token exchange service](<https://vercel.com/changelog/custom-oidc-token-audiences>) handles this without extra infrastructure. It takes the token a deployment already receives and returns a new one signed with the same key but a different audience, for example *sts.amazonaws.com* for AWS access via the **@vercel/oidc-aws-credentials-provider** package. The exchanged token:

- Preserves the original claims: project, environment, owner and expiration

- Sets the issuer to https://oidc.vercel.com/{owner}, scoped to the team that owns the deployment

- Adds an *act* (actor) claim recording the original token's audience and issued-at time, for an auditable delegation chain

- Updates the *aud* to the requested downstream audience and the *iat* to the exchange time

A *jti* can optionally be set on the exchanged token to trace a specific exchange through downstream logs. Downstream services verify the token against the public key at https://oidc.vercel.com/{owner}/.well-known/jwks; both the signing key and the exchange endpoint are replicated across all Vercel regions.

[![](<https://vercel.com/api/dynamic-og?title=Custom%20OIDC%20Token%20Audiences&format=changelog>)](<https://vercel.com/changelog/custom-oidc-token-audiences>)

![Vercel](<https://www.google.com/s2/favicons?domain=vercel.com&sz=128>)

Vercel

The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.

[View Vercel →](<https://creatorstoolbox.com/tools/vercel>)

Sources

[Original source](<https://vercel.com/changelog/custom-oidc-token-audiences>)

[Read Custom OIDC Token Audiences on Creators Toolbox](<https://creatorstoolbox.com/blog/vercel-custom-oidc-token-audiences>)

---
Canonical source: https://creatorstoolbox.com/blog/vercel-custom-oidc-token-audiences