#Oidc

Vercel now supports OIDC Federation in beta, replacing long-lived credentials with short-lived, signed tokens for external requests from builds and functions.

Vercel's OpenID Connect (OIDC) Federation is now generally available. Strengthen your security by replacing long-lived environment variable credentials with short-lived, RSA-signed JWTs for builds and Vercel Functions.

Long-lived credentials in CI are one of the top breach vectors. Learn to swap stored keys for short-lived, scoped, keyless OIDC auth, and keep secrets

Vercel is working to replace long-lived static credentials through expanded OIDC support, OIDC UI tooling, and Marketplace authentication requirements.

Vercel Blob now supports OIDC authentication. Use short-lived tokens scoped to your project to authenticate without using long-lived credentials.

The skills.sh API is now available. Authenticate with a Vercel OIDC token to query more than 600,000 skills from across the open-source ecosystem.

Vercel Passport lets you protect deployments with your own identity provider. Visitors authenticate with your identity provider before they can view a protected deployment.

Vercel's OIDC issuer now supports custom audiences. Deployments can request OIDC tokens with a specific audience claim, enabling secure service-to-service authentication with third-party providers.

Vercel Remote Cache supports OpenID Connect (OIDC), allowing Turborepo to access the cache using OIDC tokens from CI/CD providers.

"SAML, the XML-based authentication protocol that birthed the SSO industry, is fundamentally flawed due to XML complexity, canonicalization issues, enveloped signatures, and design ossification, making it vulnerable to signature wrapping attacks and…

Vercel OpenID Connect support helps you replace long-lived credentials with temporary tokens to reduce risk.

You can now authorize specific Vercel projects and external CI services to reach this project's protected deployments using short-lived OIDC tokens, without sharing a static bypass secret or opening the deployment to the public internet

OIDC authentication worked correctly throughout the TanStack attack. The build cache is the substrate...

Implement OAuth 2.0 and OpenID Connect from scratch — understand authorization codes, PKCE, JWT tokens, and security best practices.

I rotated a leaked AWS access key at 2 AM last year. A contractor had pushed a workflow that printed...

From Dev Community: Stop Manually Wiring Azure AD Auth — Here's a Secure-by-Default .NET 8 Template

From Dev.to - aws: How I Used OIDC to Eliminate Static AWS Keys from GitHub Actions (Real Pipeline Walkthrough)

You built an internal app with Claude Code or Cursor. It works. The logic is solid. Your team wants...

The eight checks every production JWT verifier must do, what each one prevents, and structured error codes for each failure mode. A reference doc for backend and identity teams.

From Dev.to - security: Step-by-Step: Set Up Zero-Trust Security with HashiCorp Vault 1.16 and AWS IAM Identity Center 2026-02