---
id: vercel-oidc
version: "0.8.0"
license: MIT
license_treatment: permissive
maintenance: active
---

# vercel-oidc — OIDC helpers for Vercel Python applications

License: permissive · Maintenance: active · Downloads: 1.2M/mo

## What it is and what it does

vercel-oidc is a library for working with OpenID Connect tokens issued by Vercel's OIDC service. It provides functions to retrieve tokens from request headers or environment variables, decode their payloads to extract claims like project_id, and optionally verify signatures using Vercel's public key set. The library supports both synchronous and asynchronous code paths and includes a token identity resolver that produces a stable digest safe for logging.

The package is designed for Vercel Python applications that need to authenticate workloads or validate incoming requests. Token retrieval prefers the x-vercel-oidc-token header (registered via vercel.headers.set_headers) and falls back to the VERCEL_OIDC_TOKEN environment variable. Verification is optional but when enabled enforces RS256 signatures, pins the issuer to Vercel's OIDC endpoints, and fails closed if the expected project or environment cannot be resolved.

Use it for:

- Retrieve and decode OIDC tokens in async Vercel Functions to extract project or environment metadata from claims.
- Verify incoming bearer tokens in request handlers to authenticate requests from other Vercel workloads.
- Generate a stable identity digest from a token for keying client-side state without exposing the token itself.
- Validate token signatures and issuer in local development by loading short-lived tokens via the vc CLI.
- Enforce project and environment isolation by failing closed when expected context cannot be resolved from configuration.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Retrieves, decodes, and verifies Vercel OIDC tokens for Python applications, with support for both synchronous and asynchronous token lookup and optional JWT signature verification.

Yes, if you are building Python applications on Vercel and need to work with OIDC tokens. The library is actively maintained, has low install friction, and provides both basic token handling and optional cryptographic verification. No known vulnerabilities. The MIT license poses no restrictions.

## Install

pip install vercel-oidc
uv add vercel-oidc
poetry add vercel-oidc

## Installing vercel-oidc

Before you install: Low install friction with a pure Python wheel and only three runtime dependencies (anyio, httpx, vercel-headers). Active maintenance with a release 6 days ago.

License in practice: MIT license permits unrestricted use, modification, and distribution with only attribution required.

Quickstart:

# Install
pip install vercel-oidc

# Async token retrieval and decode
from vercel.oidc import decode_oidc_payload
from vercel.oidc.aio import get_vercel_oidc_token

async def main():
    token = await get_vercel_oidc_token()
    payload = decode_oidc_payload(token)
    project_id = payload.get("project_id")

Requires Python 3.10 or later. Token verification requires the optional verify extra: pip install vercel-oidc[verify]

Verify before relying:

- Whether vercel-headers is a first-party Vercel package or a separate community dependency with its own maintenance status.
- Whether the optional verify extra (pyjwt[crypto]) adds significant install complexity or system dependencies beyond Python packages.

## Package facts

- License: MIT (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 1.2M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

vercel oidc token, openid connect vercel, jwt verification vercel, oidc token decode, vercel authentication python, oidc async token lookup, vercel identity verification, vercel-platform, oidc-jwt, async-support

[View on SkillFed](https://skillfed.io/packages/vercel-oidc) · [View on PyPI](https://pypi.org/project/vercel-oidc/)