Vercel's OIDC issuer ( oidc.vercel.com ) now supports custom audiences. Deployments can request OIDC tokens with a specific audience claim, enabling secure service-to-service authentication with third-party providers.

Copy link to heading Why custom audiences?

Vercel OIDC tokens are issued with a fixed audience ( https://vercel.com/{owner} ). While most cloud providers don't require a specific audience value, using a unique audience per provider is a security best practice. If a provider is compromised, an attacker cannot replay the token against a different provider - the mismatched aud claim will cause verification to fail. This new service makes it easy to mint provider-specific tokens without managing additional infrastructure.

Copy link to heading How it works

When a Vercel deployment runs, it receives an OIDC token signed by Vercel.…