Use @vercel/oidc utilities to reduce auth duplication by gr2m · Pull Request #34 · vercel/sandbox

gr2m · 2026-02-05T00:35:48Z

Summary

This PR refactors the authentication logic to use utilities from @vercel/oidc, reducing code duplication and improving maintainability.

Changes

Use @vercel/oidc optional parameters to reduce duplication in auth flow
Remove duplicate auth logic by leveraging shared utilities
Update dependency to local path for testing purposes
Update tests to reflect simplified auth logic

Test plan

Existing auth tests pass
Manual testing of auth flows
Verify behavior matches previous implementation

🤖 Generated with Claude Code

Pass teamId and projectId to getVercelOidcToken() to enable token refresh without needing to read from .vercel/project.json. This removes duplication between @vercel/oidc and Sandbox's credential management. Changes: - get-credentials.ts: Pass opts.teamId/projectId when calling getVercelOidcToken() - jwt-expiry.ts: Pass payload.owner_id/project_id when refreshing tokens Benefits: - Token refresh works without .vercel/project.json when credentials are known - Reduces filesystem dependencies in token refresh flow - Maintains backward compatibility - still parses JWT for credential extraction - All 57 tests continue to pass

Replaced Sandbox's custom auth refresh logic with @vercel/oidc's getVercelCliToken() which handles: - Reading auth.json - Checking token expiry - Refreshing with OAuth - Saving updated tokens Removed code: - refreshToken() function (~30 lines) - Imports from @vercel/sandbox/dist/auth (getAuth, updateAuthConfig, OAuth, isOAuthError) Added: - Import getVercelCliToken, NoAuthConfigError, TokenExpiredError, RefreshFailedError from @vercel/oidc - Error handling to trigger login when auth is missing/expired Benefits: - 32 net lines removed (65 deletions, 33 insertions) - Single source of truth for auth refresh logic - Better error handling with specific error types - All tests passing (6/6)

vercel · 2026-02-05T00:35:53Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Updated (UTC)
sandbox-cli	Error	Feb 5, 2026 10:08pm
sandbox-sdk	Error	Feb 5, 2026 10:08pm
sandbox-sdk-ai-example	Error	Feb 5, 2026 10:08pm

Follows the rename of NoAuthConfigError to NoAuthError in @vercel/oidc. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Follows the removal of TokenExpiredError in @vercel/oidc, which now only throws NoAuthError or RefreshFailedError. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Follows the rename of NoAuthError to AccessTokenMissingError in @vercel/oidc. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

gr2m · 2026-02-05T03:15:45Z

packages/sandbox/src/args/auth.ts

-          refreshed === "invalid refresh token"
+      // Try to get CLI token, which handles auth.json reading and refresh
+      try {
+        return await getVercelCliToken();


Do we need an access token? Or could we also get an OIDC token for Sandbox?

Handling the access token is good idea. But then it should actually be called "access token". And we should also allow it be specified via an env var, e.g. VERCEL_TOKEN. But IMHO it shouldn't be API'd to CLI specifically.

Follows the rename of RefreshFailedError to RefreshAccessTokenFailedError in @vercel/oidc. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Simplifies token management by using the new bufferMs option in getVercelOidcToken() instead of maintaining a separate JwtExpiry class. This consolidates token expiry logic in the @vercel/oidc package. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Follows the rename of bufferMs to expirationBufferMs in @vercel/oidc. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

…ails

dvoytenko · 2026-02-06T16:45:50Z

packages/sandbox/src/args/auth.ts

-          refreshed === "invalid refresh token"
+      // Try to get CLI token, which handles auth.json reading and refresh
+      try {
+        return await getVercelCliToken();


Handling the access token is good idea. But then it should actually be called "access token". And we should also allow it be specified via an env var, e.g. VERCEL_TOKEN. But IMHO it shouldn't be API'd to CLI specifically.

dvoytenko · 2026-02-06T16:46:58Z

packages/sandbox/package.json

    "@types/ms": "^2.1.0",
    "@types/node": "^22.15.12",
-    "@vercel/oidc": "^3.1.0",
+    "@vercel/oidc": "file:../../../vercel/packages/oidc",


I'm working on it locally, this is a local install path for local testing. Once the @vercel/oidc PR ships I'll update it.

gr2m · 2026-02-07T00:39:41Z

But then it should actually be called "access token". And we should also allow it be specified via an env var, e.g. VERCEL_TOKEN. But IMHO it shouldn't be API'd to CLI specifically.

I'm not sure, access token can mean anything, but here we specifically trying to get the Vercel CLI access token. E.g. gateway has its own access token independent of OIDC and CLI. I think getVercelCliToken is the right name, in future we will replace the implementation of it to use exec which will invoke the cli directly.

gr2m added 3 commits February 4, 2026 16:06

update dependency version to local path for testing

62e37de

vercel bot had a problem deploying to Preview – sandbox-cli February 5, 2026 00:35 Failure

vercel bot had a problem deploying to Preview – sandbox-sdk February 5, 2026 00:35 Failure

vercel bot had a problem deploying to Preview – sandbox-sdk-ai-example February 5, 2026 00:35 Failure

gr2m and others added 3 commits February 4, 2026 18:40

Update to use NoAuthError from @vercel/oidc

ac18fb5

Follows the rename of NoAuthConfigError to NoAuthError in @vercel/oidc. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Remove TokenExpiredError import from @vercel/oidc

af4a294

Follows the removal of TokenExpiredError in @vercel/oidc, which now only throws NoAuthError or RefreshFailedError. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Update to use AccessTokenMissingError from @vercel/oidc

6c74006

Follows the rename of NoAuthError to AccessTokenMissingError in @vercel/oidc. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

vercel bot had a problem deploying to Preview – sandbox-cli February 5, 2026 02:48 Failure

vercel bot had a problem deploying to Preview – sandbox-sdk February 5, 2026 02:48 Failure

vercel bot had a problem deploying to Preview – sandbox-sdk-ai-example February 5, 2026 02:48 Failure

gr2m commented Feb 5, 2026

View reviewed changes

Update to use RefreshAccessTokenFailedError from @vercel/oidc

269e276

Follows the rename of RefreshFailedError to RefreshAccessTokenFailedError in @vercel/oidc. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

vercel bot had a problem deploying to Preview – sandbox-cli February 5, 2026 03:30 Failure

vercel bot had a problem deploying to Preview – sandbox-sdk February 5, 2026 03:30 Failure

vercel bot had a problem deploying to Preview – sandbox-sdk-ai-example February 5, 2026 03:30 Failure

vercel bot had a problem deploying to Preview – sandbox-cli February 5, 2026 04:11 Failure

vercel bot had a problem deploying to Preview – sandbox-sdk February 5, 2026 04:11 Failure

vercel bot had a problem deploying to Preview – sandbox-sdk-ai-example February 5, 2026 04:11 Failure

Update to use expirationBufferMs from @vercel/oidc

1becbe0

Follows the rename of bufferMs to expirationBufferMs in @vercel/oidc. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

vercel bot had a problem deploying to Preview – sandbox-cli February 5, 2026 04:24 Failure

vercel bot had a problem deploying to Preview – sandbox-sdk-ai-example February 5, 2026 04:24 Failure

vercel bot had a problem deploying to Preview – sandbox-sdk February 5, 2026 04:24 Failure

gr2m mentioned this pull request Feb 5, 2026

feat(oidc): add optional argument getVercelOidcToken({ teamId, projectId }) vercel/vercel#14864

Open

vercel bot had a problem deploying to Preview – sandbox-cli February 5, 2026 22:03 Failure

vercel bot had a problem deploying to Preview – sandbox-sdk February 5, 2026 22:03 Failure

vercel bot had a problem deploying to Preview – sandbox-sdk-ai-example February 5, 2026 22:03 Failure

Rewrite auth tests to mock @vercel/oidc instead of implementation det…

76d85ab

…ails

gr2m force-pushed the vercel-oidc-update branch from 3165adc to 76d85ab Compare February 5, 2026 22:07

vercel bot had a problem deploying to Preview – sandbox-sdk February 5, 2026 22:08 Failure

vercel bot had a problem deploying to Preview – sandbox-sdk-ai-example February 5, 2026 22:08 Failure

vercel bot had a problem deploying to Preview – sandbox-cli February 5, 2026 22:08 Failure

dvoytenko requested changes Feb 6, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use @vercel/oidc utilities to reduce auth duplication#34

Use @vercel/oidc utilities to reduce auth duplication#34
gr2m wants to merge 10 commits intomainfrom
vercel-oidc-update

gr2m commented Feb 5, 2026

Uh oh!

vercel bot commented Feb 5, 2026 •

edited

Loading

Uh oh!

gr2m Feb 5, 2026

Uh oh!

dvoytenko Feb 6, 2026

Uh oh!

dvoytenko Feb 6, 2026

Uh oh!

dvoytenko Feb 6, 2026

Uh oh!

gr2m Feb 7, 2026

Uh oh!

gr2m commented Feb 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

gr2m commented Feb 5, 2026

Summary

Changes

Related

Test plan

Uh oh!

vercel bot commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gr2m Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

dvoytenko Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

dvoytenko Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

dvoytenko Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

gr2m Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

gr2m commented Feb 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vercel bot commented Feb 5, 2026 •

edited

Loading