Vercel's OIDC issuer now supports custom audience claims, allowing deployments to request tokens with provider-specific `aud` values. A new token exchange service accepts the default Vercel OIDC token and returns a new one with an updated audience targeting a downstream service (e.g., `sts.amazonaws.com` for AWS). The exchanged token preserves all original claims, adds an `act` (actor) claim for auditable delegation, and is signed with the same key. Public JWKS endpoints are replicated across all Vercel regions for low-latency verification. This improves security by preventing token replay attacks across different providers.
649 Impressions