# Custom OIDC Token Audiences

DevFeed: [Custom OIDC Token Audiences](<https://devfeed.tech/articles/custom-oidc-token-audiences-884.md>)

Original publisher: [Read original article](<https://vercel.com/changelog/custom-oidc-token-audiences>)

Author: Bel Curcio

Published: 2026-06-23T00:00:00Z

Content type: release

Language: en

Sources: [Vercel News](<https://devfeed.tech/sources/vercel-news.md>)

Topics: [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [Vercel](<https://devfeed.tech/topics/vercel.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Security](<https://devfeed.tech/topics/security.md>), [API](<https://devfeed.tech/topics/api.md>), [Low Latency](<https://devfeed.tech/topics/low-latency.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [jwks](<https://devfeed.tech/tags/jwks.md>), [low-latency](<https://devfeed.tech/tags/low-latency.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [security](<https://devfeed.tech/tags/security.md>), [signing](<https://devfeed.tech/tags/signing.md>), [tokens](<https://devfeed.tech/tags/tokens.md>), [tracing](<https://devfeed.tech/tags/tracing.md>), [vercel](<https://devfeed.tech/tags/vercel.md>), [verification](<https://devfeed.tech/tags/verification.md>)

## AI overview

Vercel now supports custom audiences for OIDC tokens. Deployments can exchange a Vercel-issued token for one targeting a specific downstream service, enabling secure service-to-service authentication with third-party providers.

## Source excerpt

Vercel's OIDC issuer (oidc.vercel.com) now supports custom audiences. Deployments can request OIDC tokens with a specific audience claim, enabling secure service-to-service authentication with third-party providers. Why custom audiences? Vercel OIDC tokens are issued with a fixed audience (https://vercel.com/{owner}). While most cloud providers don't require a specific audience value, using a unique audience per provider is a security best practice. If a provider is compromised, an attacker cannot replay the token against a different provider - the mismatched aud claim will cause verification to fail. This new service makes it easy to mint provider-specific tokens without managing additional infrastructure. How it works When a Vercel deployment runs, it receives an OIDC token signed by Vercel. The new exchange service accepts this token and returns a new one signed with the same key, but with an updated audience (aud) claim targeting your downstream service. The exchanged token: Preserves all original claims (project, environment, owner, expiration) Sets the iss (issuer) to https://oidc.vercel.com/{owner}, scoped to the team that owns the deployment Includes an act (actor) claim with the original token's audience and issued-at time, providing an auditable delegation chain Updates the aud to the requested downstream audience Updates the iat (issued-at) to the current timestamp, reflecting when the new token was created You can optionally pass a jti (JWT ID) to assign a unique identifier to the exchanged token. This is useful for auditing and tracing token usage across services - for example, correlating a specific token exchange with downstream API calls in your logs. Downstream services verify the exchanged token using the public key available at https://oidc.vercel.com/{owner}/.well-known/jwks. Both the signing key and the token exchange endpoint are replicated across all Vercel regions, ensuring low-latency token exchange regardless of where the deployment is runn