Manage Sign in with Vercel from the Dashboard

To manage any third-party apps, or create a new one yourself, you need to create an App. An App acts as an intermediary that requests and manages access to resources on behalf of the user. It communicates with the Vercel Authorization Server to get tokens which act as credentials for accessing protected resources through the Vercel REST API.

To create an App, follow these steps:

1. Navigate to your team's Settings section in the sidebar
2. Scroll down and select Apps, and click Create
3. Choose a name for your app
4. Choose a slug for your app (The slug is automatically generated from the name if you don't provide one)
5. Optionally add a logo for your app
6. Click Save

The client authentication method determines how your app will authenticate with the Vercel Authorization Server. You can enable multiple methods to provide flexibility for your app in different deployment scenarios.

To enable OIDC-based authentication after you create an app:

1. Navigate to the Manage page for your app
2. Open Authentication in the sidebar
3. Under OpenID Connect, select oidc_token
4. Click Add Issuer and choose an issuer. The menu offers templates such as GitHub Actions, plus a Custom option.
5. Configure the Issuer URL and the claims the token must present
6. Click Save

You must configure at least one complete issuer before saving. If no issuer is complete, the dashboard rejects the save and asks you to add an issuer with an issuer URL and matching claims, or turn off OpenID Connect.

Each issuer entry is an issuer URL plus claims, where claims map a claim name to a list of allowed values. Within one entry, Vercel ANDs the claim names and ORs the allowed values for each claim. Matching uses exact string equality, so * is a literal character rather than a wildcard, the same semantics as Deployment Protection trusted sources. Multiple entries may share an issuer URL to express alternatives, and any one matching entry authenticates. You can configure up to 10 issuer entries per app. The issuer URL must be a valid URL up to 2048 characters. Each entry has 1 to 20 claim names, each claim has 1 to 20 allowed values, claim names can be up to 64 characters, and claim values can be up to 256 characters.

Learn how to present an OIDC token when requesting a token in Authenticate with an OIDC token.

To enable private_key_jwt after you create an app:

1. Navigate to the Manage page for your app
2. Open Authentication in the sidebar
3. Select private_key_jwt
4. Enter your JWKS URL. For a key you host yourself, use a URL such as https://example.com/.well-known/jwks.json. For a Vercel KMS issuer, use https://kms.vercel.com/<issuerId>/jwks.json.
5. Click Save

The JWKS URL must use HTTPS and can be up to 2048 characters. You must provide a JWKS URL when private_key_jwt is enabled. Vercel fetches public keys from this URL when verifying client assertions. The JWKS document can contain up to 32 keys and must be 64 KB or smaller.

Learn how to build and send JWT client assertions in Authenticate with a JWT assertion. To sign with KMS instead of a local private key, see Sign the assertion with Vercel KMS.

A client secret is only necessary if you plan to use the client_secret_basic, client_secret_post, or client_secret_jwt authentication methods.

Client secrets are used to authenticate your app with the Vercel Authorization Server. You can generate a client secret by clicking the Generate button.

The authorization callback URL is where Vercel redirects users after they authorize your app. This URL must be registered to prevent unauthorized redirects and protect against malicious attacks.

To add a callback URL:

1. Navigate to the Manage page for your app
2. Scroll to Authorization Callback URLs
3. Enter your callback URL
4. Click Add

For local development, add http://localhost:3000/api/auth/callback. For production, add https://your-domain.com/api/auth/callback. For Apps hosted on Vercel, instead of specifying a custom domain for the callback URL, you can instead select a Vercel project from a dropdown in the UI. This will let you configure an authorization URL matching any of your App's deployment domains.

When a user authorizes your app, Vercel redirects them to this URL with a code query parameter. Your application exchanges this code for tokens using the Token Endpoint.

By default, anyone with a Vercel account can complete Sign in with Vercel for your app. You can instead restrict sign-in to members of the team that owns the app.

To configure sign-in access:

1. Navigate to your team's Settings
2. Select Apps, then select your app
3. On the General page, scroll to Sign-In Access
4. Choose one of the following options:
   • Anyone with a Vercel account: Any Vercel user can sign in to your app
   • Members of the team: Only current members of the team that owns the app can sign in
5. Click Save

Vercel checks this setting when a user authorizes the app, completes the device authorization flow, or refreshes their tokens. A user who does not meet the requirement receives an OAuth access_denied error.

Sign-in access applies only to user authentication through Sign in with Vercel. It does not control who can install the Vercel App or who can access deployments protected by Vercel Authentication.

Permissions control what data your app can access. Configure them from the Permissions page in your app settings.

To configure permissions:

1. Navigate to the Manage page for your app
2. Open Permissions in the sidebar
3. Enable the scopes and permissions your app needs:
   • openid: Required to issue an ID Token for user identification
   • email: Access the user's email address in the ID Token
   • profile: Access the user's name, username, and profile picture in the ID Token
   • offline_access: Issue a Refresh Token to get new Access Tokens without re-authentication
4. Click Save

When users authorize your app, they'll see these permissions on the consent page and decide whether to grant access.

Learn more about scopes and permissions in the scopes and permissions documentation.