Skip to content
API OIDC
Esc
↑↓navigate↵open⌘Jpreview

Your platform's token, instead of a shared API key.

Vercel, GitHub Actions, Google Cloud, AWS and GitLab give each workload a short-lived, signed token. Umbraco accepts it on the Delivery API and on the endpoints you choose.

Get startedView on GitHub
dotnet add package TheBuilder.ApiOidc

Umbraco CMS 17.1 or later · .NET 10

Why use a token instead of the key

For frontends that run on Vercel, GitHub Actions, Google Cloud, AWS, GitLab or another platform that issues OIDC tokens.

Nothing to rotate

Each token is signed by the platform and expires on its own. There is no key to copy into each project's environment variables.

You list who gets in

A Vercel team, a set of GitHub repositories or a cloud service account. Tokens from anywhere else are refused.

The API key still works

Public access and the API key behave as before, so you can move frontends over one at a time.

Trust an issuer in appsettings

Presets cover Vercel and GitHub Actions. Any other OIDC issuer needs its URL, an audience and the claims a token must carry.

Set up your issuer 
"ApiOidc": {
  "Issuers": [
    { "Preset": "Vercel", "Team": "acme" }
  ]
}

Send the token in a header

The frontend asks its platform for a token and sends it as X-Oidc-Token. Your own endpoints can require the same token with an attribute.

Protect your own endpoints
import { getVercelOidcToken } from "@vercel/oidc";

const url = new URL("/umbraco/delivery/api/v2/content", UMBRACO_URL);
const response = await fetch(url, {
  headers: { "X-Oidc-Token": await getVercelOidcToken() },
});

Try it on one frontend

Install the package, add your platform's issuer, and send the token from one frontend. The others keep using the API key until you move them.

Read the quickstart

More from TheBuilder

Focused packages for modern Umbraco projects.