OIDC + React2Shell Issues

Help
, , ,
1

So I’m facing two issues;

  1. I have updated my vulnerabilities + deployed it to my project. I’m still receiving the “Take action against to secure your project.” message which is stopping me from deploying anything else.
  2. My OIDC token is not refreshing during production. I have had to manually run “vercel env pull” + “vercel --prod” if I want to run it on production.

For 1, I have enabled Vercel Authentication as I read that this was a temp fix, so I’ll be waiting some time to see how that goes. As for 2, I have been facing this issue but found no proper fix. I’ve been following the documentation and still run into issues.

Please help! This is all for my AI Gateway Hackathon, project and I’d love to have it be production-ready :slight_smile:

2

Did you know there’s another category dedicated to v0 topics? A human should be here soon to help, but the answer may already be available even faster in one of these other posts.

Our docs are a great place to start.

We also have a walkthrough to help guide your workflow.

And these recordings can give you a look at v0 features and strategies in action shown by our Community:

https://community.vercel.com/tags/c/events/42/v0

5

If you’ve updated the code and it successfully deployed you’re safe, but we do show several categories of issues under that banner.

Old preview environments (for every historical commit) will still have the old versions, so setting deployment protection to Standard will protect those. If that’s not the error you’re getting (and it’s been more than a few minutes to rule out cache issues) can you share a screenshot of what is?

The OIDC token should not be present in your Vercel dashboard or .env if you’re deploying locally in order to rotate properly

6

Hey Jacob! So I got problem #1 fixed:

  • When I pulled/merged that issue, it auto-redeployed the Vercel Project, but I guess it didn’t properly take place? I had to pull that into VSCode and then redeploy it from the CLI for it to work.

As for problem #2, Im getting the following errors after removing any instance of the OIDC token from my .env and dashboard:

image
image1456×924 130 KB

Here’s a token check I logged for reference:

[AI Gateway] Token check: {
  hasVercelOIDC: false,
  hasAPIKey: true,
  hasToken: true,
  tokenPrefix: 'ck_2Xkj1aVAnzriiKMgS...',
  environment: 'production',
  vercelEnv: 'production'
}
7

Dug into this and it looks like the process.env.VERCEL_OIDC_TOKEN environment variable is stripped out during the deploy process

You can get the token from the @vercel/oidc package instead, which handles the automatic rotation (whereas environment variables require redeploys to rotate)

import { getVercelOidcToken } from '@vercel/oidc';

I noticed you’re making manual fetch calls to the gateway – you don’t actually need to do this to use Gateway. Declaring a string model with the AI SDK will use your OIDC token under the hood to connect to Gateway automatically

import { generateText } from 'ai';

const { text } = await generateText({
  model: "anthropic/claude-sonnet-4.5",
  prompt: 'Invent a new holiday and describe its traditions.',
});

console.log(text);
8

It works perfectly Jacob!! Thanks so much for your help. Here’s the site if you wanna take a look: