--- title: Manage Sign in with Vercel from the Dashboard product: vercel url: /docs/sign-in-with-vercel/manage-from-dashboard canonical_url: "https://vercel.com/docs/sign-in-with-vercel/manage-from-dashboard" last_updated: 2026-08-21 type: how-to prerequisites: - /docs/sign-in-with-vercel related: - /docs/sign-in-with-vercel/authorization-server-api - /docs/rest-api - /docs/deployment-protection/methods-to-bypass-deployment-protection/trusted-sources - /docs/kms - /docs/deployment-protection/methods-to-protect-deployments/vercel-authentication summary: Learn how to manage Sign in with Vercel from the Dashboard install_vercel_plugin: npx plugins add vercel/vercel-plugin --- # Manage Sign in with Vercel from the Dashboard ## Create an App To manage any third-party apps, or create a new one yourself, you need to create an App. An App acts as an intermediary that requests and manages access to resources on behalf of the user. It communicates with the [Vercel Authorization Server](/docs/sign-in-with-vercel/authorization-server-api) to get tokens which act as credentials for accessing protected resources through the [Vercel REST API](/docs/rest-api). ## Related pages > **For AI agents:** Follow these links to understand how this page connects to the rest of the Vercel ecosystem. For the full cross-link map (inbound, outbound, prerequisites, and semantic neighbors), see the .graph.md link below. - [The complete guide to authentication on Vercel](https://vercel.com/kb/guide/complete-guide-authentication-vercel) — Learn how to implement authentication in your Vercel applications. Covers NextAuth/Auth.js setup, environment variable c - [How do I use a Vercel API Access Token?](https://vercel.com/kb/guide/how-do-i-use-a-vercel-api-access-token) — Create a Vercel API access token, scope it to your account, a team, or a project, and use it to authenticate Vercel REST - [Troubleshooting Sign in with Vercel](https://vercel.com/docs/sign-in-with-vercel/troubleshooting) — Learn how to troubleshoot common errors with Sign in with Vercel - [Vercel KMS Authentication](https://vercel.com/docs/kms/concepts/authentication) — How Vercel KMS authorizes signing requests with a deployment OIDC token, authorizes management requests with a Vercel ac - [Auth.js with Vercel Connect](https://vercel.com/docs/connect/frameworks/authjs) — Add a Vercel Connect OAuth provider to Auth.js in a Next.js App Router application. - [Access tokens](https://vercel.com/docs/accounts/access-tokens) — Create and scope Vercel access tokens to your full account, a team, or a single project, then use them to authenticate A - [Project settings](https://vercel.com/docs/project-configuration/project-settings) — Use the project settings, to configure custom domains, environment variables, Git, integrations, deployment protection, Full cross-link map for this page: [/docs/sign-in-with-vercel/manage-from-dashboard.graph.md](/docs/sign-in-with-vercel/manage-from-dashboard.graph.md) To create an App, follow these steps: 1. Navigate to your team's [**Settings**](https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fsettings\&title=Go+to+team+settings) section in the sidebar 2. Scroll down and select **Apps**, and click **Create** 3. Choose a name for your app 4. Choose a slug for your app (The slug is automatically generated from the name if you don't provide one) 5. Optionally add a logo for your app 6. Click **Save** | Field | Required | Description | | ----- | -------- | ------------------------------------------------------------------------------------------------------------------------------------ | | Name | Yes | The name of your app. It must be unique across all Vercel applications. Example: `My App` | | Slug | Yes | The slug of your app. A URL friendly name that uniquely identifies your app. Defaults to the name if not provided. Example: `my-app` | | Logo | Optional | The logo that represents your app. | ## Choose your client authentication method The client authentication method determines how your app will authenticate with the Vercel Authorization Server. You can enable multiple methods to provide flexibility for your app in different deployment scenarios. | Field | Description | Usage | Security | | --------------------- | ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- | | `client_secret_basic` | HTTP Basic Authentication Scheme | Client credentials are sent via HTTP Basic Authentication header (Authorization: Basic ``) | Suitable for server-side applications that can securely store credentials | | `client_secret_post` | HTTP request body as a form parameter | Client credentials are included as form parameters in the request body (`client_id` and `client_secret`) | The same as `client_secret_basic` | | `client_secret_jwt` | JWT signed with the client secret | Client authenticates using a JWT signed with HS256, HS384, or HS512. Vercel verifies the assertion against each active client secret. | Provides additional security by avoiding the transmission of the client secret in requests | | `oidc_token` | OIDC token issued by a trusted issuer | Client authenticates with an OIDC token issued by a trusted issuer, such as GitHub Actions or Vercel. Vercel verifies the token's signature against the issuer's published keys and matches its claims against the issuer policies you configure. | Suitable for workloads that already have OIDC support and cannot or should not store long-lived secrets | | `private_key_jwt` | JWT signed with the app's private key | Client authenticates using a JWT signed with a private key. Vercel verifies the signature using public keys from your JWKS URL. Include a `kid` header when the JWKS has more than one key. | Suitable for server-side applications that store a private key and publish public keys at a JWKS URL | | `none` | For public, unauthenticated, non-confidential clients | No client authentication required - suitable for public applications that cannot securely store secrets | For single page applications (SPAs), mobile apps, and CLIs that cannot securely store credentials | ## Configure OIDC-based authentication To enable OIDC-based authentication after you create an app: 1. Navigate to the **Manage** page for your app 2. Open **Authentication** in the sidebar 3. Under **OpenID Connect**, select **oidc\_token** 4. Click **Add Issuer** and choose an issuer. The menu offers templates such as GitHub Actions, plus a Custom option. 5. Configure the **Issuer URL** and the claims the token must present 6. Click **Save** You must configure at least one complete issuer before saving. If no issuer is complete, the dashboard rejects the save and asks you to add an issuer with an issuer URL and matching claims, or turn off OpenID Connect. Each issuer entry is an issuer URL plus claims, where claims map a claim name to a list of allowed values. Within one entry, Vercel ANDs the claim names and ORs the allowed values for each claim. Matching uses exact string equality, so `*` is a literal character rather than a wildcard, the same semantics as [Deployment Protection trusted sources](/docs/deployment-protection/methods-to-bypass-deployment-protection/trusted-sources). Multiple entries may share an issuer URL to express alternatives, and any one matching entry authenticates. You can configure up to 10 issuer entries per app. The issuer URL must be a valid URL up to 2048 characters. Each entry has 1 to 20 claim names, each claim has 1 to 20 allowed values, claim names can be up to 64 characters, and claim values can be up to 256 characters. Learn how to present an OIDC token when requesting a token in [Authenticate with an OIDC token](/docs/sign-in-with-vercel/authorization-server-api#authenticate-with-an-oidc-token). ## Configure private key-based authentication To enable `private_key_jwt` after you create an app: 1. Navigate to the **Manage** page for your app 2. Open **Authentication** in the sidebar 3. Select **private\_key\_jwt** 4. Enter your **JWKS URL**. For a key you host yourself, use a URL such as `https://example.com/.well-known/jwks.json`. For a [Vercel KMS](/docs/kms) issuer, use `https://kms.vercel.com//jwks.json`. 5. Click **Save** The JWKS URL must use HTTPS and can be up to 2048 characters. You must provide a JWKS URL when `private_key_jwt` is enabled. Vercel fetches public keys from this URL when verifying client assertions. The JWKS document can contain up to 32 keys and must be 64 KB or smaller. Learn how to build and send JWT client assertions in [Authenticate with a JWT assertion](/docs/sign-in-with-vercel/authorization-server-api#authenticate-with-a-jwt-assertion). To sign with KMS instead of a local private key, see [Sign the assertion with Vercel KMS](/docs/sign-in-with-vercel/authorization-server-api#sign-the-assertion-with-vercel-kms). ## Generate a client secret A client secret is only necessary if you plan to use the `client_secret_basic`, `client_secret_post`, or `client_secret_jwt` authentication methods. Client secrets are used to authenticate your app with the Vercel Authorization Server. You can generate a client secret by clicking the **Generate** button. > **💡 Note:** You can have up to two active client secrets at a time. This lets you rotate > secrets without downtime. ## Configure the authorization callback URL The authorization callback URL is where Vercel redirects users after they authorize your app. This URL must be registered to prevent unauthorized redirects and protect against malicious attacks. To add a callback URL: 1. Navigate to the **Manage** page for your app 2. Scroll to **Authorization Callback URLs** 3. Enter your callback URL 4. Click **Add** For local development, add `http://localhost:3000/api/auth/callback`. For production, add `https://your-domain.com/api/auth/callback`. For Apps hosted on Vercel, instead of specifying a custom domain for the callback URL, you can instead select a Vercel project from a dropdown in the UI. This will let you configure an authorization URL matching any of your App's deployment domains. When a user authorizes your app, Vercel redirects them to this URL with a `code` query parameter. Your application exchanges this code for tokens using the [Token Endpoint](/docs/sign-in-with-vercel/authorization-server-api#token-endpoint). ## Configure sign-in access By default, anyone with a Vercel account can complete Sign in with Vercel for your app. You can instead restrict sign-in to members of the team that owns the app. To configure sign-in access: 1. Navigate to your team's [**Settings**](https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fsettings\&title=Go+to+team+settings) 2. Select **Apps**, then select your app 3. On the **General** page, scroll to **Sign-In Access** 4. Choose one of the following options: - **Anyone with a Vercel account**: Any Vercel user can sign in to your app - **Members of the team**: Only current members of the team that owns the app can sign in 5. Click **Save** Vercel checks this setting when a user authorizes the app, completes the device authorization flow, or refreshes their tokens. A user who does not meet the requirement receives an OAuth `access_denied` error. > **💡 Note:** Changing sign-in access does not end sessions that your application has > already created. Your application controls its own sessions and should set an > appropriate session lifetime. If you restrict an app to team members, Vercel > denies future token refreshes after a user is no longer a member of the team. Sign-in access applies only to user authentication through Sign in with Vercel. It does not control who can install the Vercel App or who can access deployments protected by [Vercel Authentication](/docs/deployment-protection/methods-to-protect-deployments/vercel-authentication). ## Configure the necessary permissions Permissions control what data your app can access. Configure them from the **Permissions** page in your app settings. To configure permissions: 1. Navigate to the **Manage** page for your app 2. Open **Permissions** in the sidebar 3. Enable the scopes and permissions your app needs: - **openid**: Required to issue an ID Token for user identification - **email**: Access the user's email address in the ID Token - **profile**: Access the user's name, username, and profile picture in the ID Token - **offline\_access**: Issue a Refresh Token to get new Access Tokens without re-authentication 4. Click **Save** When users authorize your app, they'll see these permissions on the consent page and decide whether to grant access. Learn more about scopes and permissions in the [scopes and permissions](/docs/sign-in-with-vercel/scopes-and-permissions) documentation. --- [View full sitemap](/docs/sitemap)