Workload Identity for Vercel

Vercel can give your functions an OIDC token for the project. Dodo Payments trusts this token through a vercel provider.

Provider Settings

Setting	Value
Provider type	`vercel`
Issuer	`https://oidc.vercel.com/<team_slug>` (team issuer mode)
Audience	Must be `https://live.dodopayments.com` or `https://test.dodopayments.com`
Replay protection	Not enforced. The audience and the claim pins replace it.
JWT lifetime	1 hour or less.

The team slug has lowercase letters, digits, and hyphens only.

Required Claims

The mapping must pin both owner_id (the team id) and project_id. Add environment to limit the trust to one environment:

[
  { "claim": "owner_id", "value": "team_..." },
  { "claim": "project_id", "value": "prj_..." },
  { "claim": "environment", "value": "production" }
]

Project Configuration

In the Vercel project, open Settings → Security and turn on Secure backend access with OIDC federation.
Select the Team issuer mode.
Add DODO_PAYMENTS_IDENTITY_PROVIDER_ID with the value wip_... to the project environment variables.

Token Audience

The default aud claim of a Vercel OIDC token is https://vercel.com/<team_slug>. Dodo Payments does not accept this audience. Use getVercelOidcToken from the @vercel/oidc package with the audience option. Vercel then gives a token with the Dodo Payments audience.

Do not use the vercel() SDK helper with a vercel provider. The helper sends the token that has the default Vercel audience, and the exchange fails.

SDK Usage

The SDK gives the default Dodo Payments audience to the provider function. Request the Vercel token with this audience:

TypeScript

import DodoPayments from 'dodopayments';
import { getVercelOidcToken } from '@vercel/oidc';

const client = new DodoPayments({
  environment: 'live_mode',
  workloadIdentity: {
    identityProviderId: process.env.DODO_PAYMENTS_IDENTITY_PROVIDER_ID,
    provider: ({ audience }) => getVercelOidcToken({ audience }),
  },
});

Refer to SDK Usage for the other languages.

Getting Started

Features

Integrate

Merchant of Record

Miscellaneous

Provider Settings

Required Claims

Project Configuration

Token Audience

SDK Usage

​Provider Settings

​Required Claims

​Project Configuration

​Token Audience

​SDK Usage

Provider Settings

Required Claims

Project Configuration

Token Audience

SDK Usage