OIDC identity tokens for Edge Functions (workload identity federation)

[David15999]

Problem. Edge Functions have no way to prove their identity to third-party services. To call a vendor API, a function needs a long-lived secret stored in function secrets. Platforms like Vercel, GitHub Actions, AWS and GCP solve this by issuing a short-lived, signed OIDC token per invocation, which identity brokers and clouds verify through a public JWKS.

Request. Issue a short-lived OIDC JWT to each Edge Function invocation (env var or local endpoint), signed by a per-project issuer with a public /.well-known/openid-configuration and JWKS. Suggested claims: iss (project issuer), sub (project::function:), aud (configurable), exp (minutes), plus project_ref and function_slug.

Why it matters. It removes stored secrets from functions and enables workload identity federation with AWS STS, GCP, Azure, and workload IAM vendors like Aembit, who has said they would add Supabase as a trust provider once such a token exists.

Our case. We run about 40 Edge Functions that call CRM and AI vendor APIs. Today they route through a relay on Vercel only because Vercel can attest its identity and Supabase cannot. Native tokens would let us remove that relay.