Custom OIDC Token Audiences

Vercel's OIDC issuer now supports custom audience claims, allowing deployments to request tokens with provider-specific aud values. A new token exchange service accepts the default Vercel OIDC token and returns a new one with an updated audience targeting a downstream service (e.g., sts.amazonaws.com for AWS). The exchanged token preserves all original claims, adds an act (actor) claim for auditable delegation, and is signed with the same key. Public JWKS endpoints are replicated across all Vercel regions for low-latency verification. This improves security by preventing token replay attacks across different providers.

Source: https://vercel.com/changelog/custom-oidc-token-audiences. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.