vercel-oidc

What it is and what it does

vercel-oidc is a library for working with OpenID Connect tokens issued by Vercel's OIDC service. It provides functions to retrieve tokens from request headers or environment variables, decode their payloads to extract claims like project_id, and optionally verify signatures using Vercel's public key set. The library supports both synchronous and asynchronous code paths and includes a token identity resolver that produces a stable digest safe for logging.

The package is designed for Vercel Python applications that need to authenticate workloads or validate incoming requests. Token retrieval prefers the x-vercel-oidc-token header (registered via vercel.headers.set_headers) and falls back to the VERCEL_OIDC_TOKEN environment variable. Verification is optional but when enabled enforces RS256 signatures, pins the issuer to Vercel's OIDC endpoints, and fails closed if the expected project or environment cannot be resolved.

Use it for:

• Retrieve and decode OIDC tokens in async Vercel Functions to extract project or environment metadata from claims.
• Verify incoming bearer tokens in request handlers to authenticate requests from other Vercel workloads.
• Generate a stable identity digest from a token for keying client-side state without exposing the token itself.
• Validate token signatures and issuer in local development by loading short-lived tokens via the vc CLI.
• Enforce project and environment isolation by failing closed when expected context cannot be resolved from configuration.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Retrieves, decodes, and verifies Vercel OIDC tokens for Python applications, with support for both synchronous and asynchronous token lookup and optional JWT signature verification.

Yes, if you are building Python applications on Vercel and need to work with OIDC tokens. The library is actively maintained, has low install friction, and provides both basic token handling and optional cryptographic verification. No known vulnerabilities. The MIT license poses no restrictions.

Install

vercel-oidc on PyPI

pip install vercel-oidc

uv add vercel-oidc

poetry add vercel-oidc

Installing vercel-oidc

Before you install

Low install friction with a pure Python wheel and only three runtime dependencies (anyio, httpx, vercel-headers). Active maintenance with a release 6 days ago.

License in practice

MIT license permits unrestricted use, modification, and distribution with only attribution required.

Quickstart

# Install
pip install vercel-oidc

# Async token retrieval and decode
from vercel.oidc import decode_oidc_payload
from vercel.oidc.aio import get_vercel_oidc_token

async def main():
    token = await get_vercel_oidc_token()
    payload = decode_oidc_payload(token)
    project_id = payload.get("project_id")

Requires Python 3.10 or later. Token verification requires the optional verify extra: pip install vercel-oidc[verify]

Verify before relying

• Whether vercel-headers is a first-party Vercel package or a separate community dependency with its own maintenance status.
• Whether the optional verify extra (pyjwt[crypto]) adds significant install complexity or system dependencies beyond Python packages.

Package facts

Evidence: vercel_oidc-0.8.0-py3-none-any.whl

Tags

More Cryptography packages