# Vercel Passport is now generally available

DevFeed: [Vercel Passport is now generally available](<https://devfeed.tech/articles/vercel-passport-is-now-generally-available-1161.md>)

Original publisher: [Read original article](<https://vercel.com/changelog/vercel-passport-generally-available>)

Author: Yanick Bélanger

Published: 2026-07-31T00:00:00Z

Content type: release

Language: en

Sources: [Vercel News](<https://devfeed.tech/sources/vercel-news.md>)

Topics: [Vercel](<https://devfeed.tech/topics/vercel.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Entra ID](<https://devfeed.tech/topics/entra-id.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [Back end](<https://devfeed.tech/topics/backend.md>), [Deployment](<https://devfeed.tech/topics/deployment.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [backend](<https://devfeed.tech/tags/backend.md>), [entra-id](<https://devfeed.tech/tags/entra-id.md>), [jwks](<https://devfeed.tech/tags/jwks.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [okta](<https://devfeed.tech/tags/okta.md>), [payload](<https://devfeed.tech/tags/payload.md>), [scope](<https://devfeed.tech/tags/scope.md>), [vercel](<https://devfeed.tech/tags/vercel.md>), [verify](<https://devfeed.tech/tags/verify.md>)

## AI overview

Vercel Passport is generally available for protecting Vercel deployments with Okta, Microsoft Entra ID, or another OIDC provider. It provides verified visitor identity to application code, supports group-based authorization, enables token verification in downstream services, and records successful authentications in activity and audit logs.

## Source excerpt

Vercel Passport is now generally available. Passport allows you to protect your Vercel deployments with your own identity provider. Visitors authenticate through Okta, Microsoft Entra ID, or any OIDC provider before viewing a protected deployment, and Vercel forwards a signed identity token to the deployment so application code can build on who the visitor is. Read visitor identity in application code The getIdentity() helper in @vercel/passport reads the Vercel request context and returns the authenticated visitor. Vercel strips client-supplied values for the x-vercel-oidc-passport-token header and injects the verified token after Passport validates the session, so the identity your code receives is already verified. The subject field is a stable identifier for the visitor, scoped to your team and the Vercel Connect application that links Passport to your identity provider, and externalSubject is the visitor's ID in the provider itself. The helper returns null only when a request arrives without a Passport session, because unauthenticated browser visitors are redirected to the identity provider before they ever reach your code. In local development, getIdentity() returns a configurable development identity, so the same code path works without a real identity provider. Authorize with groups from your identity provider The signed Passport token can now carry additional identity claims from your provider, such as group membership. Request the groups scope and allowlist the claim in the Vercel Connect application that Passport uses, then read it from the identity payload: The additional identity scopes documentation covers provider configuration, including a full Okta walkthrough. Verify identity in downstream services Forward the Passport token from your application to another backend as a bearer token and verify it there with verifyIdentity(), available in @vercel/passport 1.0.0 and later. The helper checks the token signature, the Passport claims, and that the token