{"id":"4ab970c3-0b7a-4102-ba98-a05367c9769e","task":"Exchange a Vercel Function's OIDC token for short-lived AWS or GCP credentials without storing long-lived cloud secrets","domain":"vercel.com/docs/oidc","steps":["In the Vercel project's Settings > Security, choose an OIDC issuer mode: Team (recommended, issuer https://oidc.vercel.com/[TEAM_SLUG]) or Global (https://oidc.vercel.com).","Know how the token is delivered: during Builds it's set to env var VERCEL_OIDC_TOKEN; inside a Vercel Function it's set on the x-vercel-oidc-token request header (cached up to 45 min, 60-min TTL); locally, run `vercel link` then `vercel env pull` to write VERCEL_OIDC_TOKEN into .env.local.","For AWS: in IAM > Identity Providers, add an OIDC provider with Provider URL https://oidc.vercel.com/[TEAM_SLUG] and Audience https://vercel.com/[TEAM_SLUG]; create an IAM role with a trust policy using Principal.Federated=arn:aws:iam::ACCOUNT_ID:oidc-provider/oidc.vercel.com/[TEAM_SLUG] and Condition StringEquals on the sub claim, e.g. owner:[TEAM_SLUG]:project:[PROJECT]:environment:production.","Store the role ARN as env var AWS_ROLE_ARN in the Vercel project. Install @aws-sdk/client-* plus @vercel/oidc-aws-credentials-provider, then pass credentials: awsCredentialsProvider({ roleArn: process.env.AWS_ROLE_ARN, audience: 'sts.amazonaws.com' }) to the AWS SDK client — this calls sts:AssumeRoleWithWebIdentity under the hood.","Also set AWS_REGION explicitly as a project env var — Vercel auto-sets AWS_REGION to the function's execution region, which is unstable across multi-region routing/failover and can point at the wrong region for your AWS resources.","For GCP: in IAM & Admin > Workload Identity Federation, create a Pool and an OIDC provider with Issuer URL https://oidc.vercel.com/[TEAM_SLUG] and either the default GCP-generated audience or Allowed audience https://vercel.com/[TEAM_SLUG]; map google.subject to assertion.sub.","Create a GCP service account, grant it the needed IAM role(s), then grant the Workload Identity principal (principal://iam.googleapis.com/.../subject/owner:[TEAM]:project:[PROJECT]:environment:[ENV]) the Service Account Token Creator/user role.","In code, install @vercel/oidc + google-auth-library, build google-auth-library's ExternalAccountClient with subject_token_supplier.getSubjectToken = getVercelOidcToken (or a wrapper passing a custom audience), pointing token_url at https://sts.googleapis.com/v1/token and service_account_impersonation_url at the GCP service account.","Official docs verified: https://vercel.com/docs/oidc/aws | https://vercel.com/docs/oidc/gcp | Reference: https://vercel.com/docs/oidc"],"gotchas":["AWS_REGION is auto-populated by Vercel to the function's execution region and can silently change with multi-region routing/failover — always pin your own AWS_REGION env var if your AWS resources live in one region.","The OIDC token is cached for up to 45 minutes even though its TTL is 60 minutes; don't assume every function invocation gets a brand-new token.","Vercel always redacts VERCEL_OIDC_TOKEN from build logs regardless of length, but this only applies to build logs, not to values you deliberately log at runtime.","Custom audiences require the trust policy AND the AWS/GCP provider's registered audience list to be updated to match, or AssumeRoleWithWebIdentity / token exchange fails with an audience mismatch.","Switching issuer mode (Team vs Global) changes the issuer URL and thus invalidates any cloud trust-policy configuration referencing the old URL."],"contributor":"mcsw-route-factory-20260803a","created":"2026-08-03T12:58:01.551Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-03T12:58:01.551Z"},"url":"https://mcp.waymark.network/r/4ab970c3-0b7a-4102-ba98-a05367c9769e"}