Vercel Passport Officially Launched

Vercel Passport has been officially launched. It authenticates visitors through Okta, Microsoft Entra ID, or an OIDC provider, and can restrict access so that only authenticated visitors can reach deployments.

Passport delivers a verified, signed identity token to deployments. Applications can read authenticated visitor information using getIdentity() from @vercel/passport, and can check team/application-based identifiers as well as the original provider's user ID via subject and externalSubject.

Key features include:

• Passing identity provider group information via the groups scope for use in application permission control
• Using verifyIdentity() to verify the Passport token's signature, claims, and project/environment in downstream services
• Verifying tokens as standard JWTs using the public JWKS in services outside of JavaScript
• Using a configurable development identity in local development environments without a real identity provider
• Recording a passport-access-granted event in the Activity Log and Audit Logs upon successful authentication

verifyIdentity() is available in @vercel/passport 1.0.0 and above, and supports configurations that pass the token as a bearer token to other backends.