Vercel issues OIDC tokens for deployments. Each team has its own issuer at https://oidc.vercel.com/<team>. Tokens can name a project and an environment. If you omit the environment, preview and production share the same access.
Docs and discovery
| Docs | OIDC Federation |
| Reference | OIDC token claims |
| Issuer | https://oidc.vercel.com/<team> (team mode) or https://oidc.vercel.com (global mode) |
| Discovery | https://oidc.vercel.com/<team>/.well-known/openid-configuration |
The default audience is https://vercel.com/<team>. A deployment can request a different audience through token exchange.
This form uses team issuer mode.
Token
| Issuer | https://oidc.vercel.com/<team> |
| Audience | https://vercel.com/<team>, or a custom audience |
| Team | owner_id (team_…) |
| Project | project_id (prj_…), optional |
| Environment | production, preview, or development, optional |
Fields
| Field | Claim | Required | Validation |
|---|---|---|---|
| Team slug | iss | Yes | Letters, digits, and hyphens. The vercel.com/<team> URL segment. |
| Team ID | owner_id | Yes | Starts with team_. Team settings, General, Team ID. |
| Project ID | project_id | No | If set, starts with prj_. Empty trusts the whole team. |
| Environment | environment | No | production, preview, or development. |
| Audience | aud | Yes | Defaults to the team URL. |
| Additional claims | other | No | Cannot reuse aud, owner_id, project_id, or environment. |
Example policy
{
issuer: "https://oidc.vercel.com/acme",
claims: {
aud: ["https://vercel.com/acme"],
owner_id: ["team_abc"],
project_id: ["prj_x"],
environment: ["production"],
},
}Add a field
Edit components/oidc/provider-vercel.tsx after install. For a one-off claim, use Additional claims. For its own input, add it to Fields (or schema), DEFAULTS, compile, parse, FIRST_CLASS_CLAIMS, and the form.
See Add a field.