Custom OIDC Token Audience Support

Vercel's OIDC issuer (oidc.vercel.com) has started supporting custom Audience (aud). You can now request a specific Audience claim at deployment time, enabling more secure service-to-service authentication with third-party providers.

Existing Vercel OIDC tokens used a fixed Audience, but the new feature allows you to generate tokens with a unique Audience for each provider. This implements a security best practice that prevents an attacker from replaying a token on other services (replay attack) even if a specific provider is compromised.

How it works and key features:

• Token exchange service: When you input an existing token issued during a Vercel deployment, it returns a new signed token that reflects the target service's Audience.
• Claim retention and updates: The existing project, environment, and owner information is retained, while aud is updated to the requested target service and iat (issued at time) is updated to the current time.
• Audit trail: The act (Actor) claim includes information from the original token, allowing the authentication delegation process to be tracked, and an optional jti (JWT ID) can be assigned for unique identification.

Exchanged tokens are verified using Vercel's public key, and are replicated across all Vercel Regions to ensure low latency.