Add @vercel/blob/s3: OIDC-backed credentials provider for the AWS S3 SDK

[falcoagustin]

Problem

Blob is getting an S3-compatible API (vercel/api#90518). S3 SDKs authenticate with an access key + secret, and we want the same zero-config DX as awsCredentialsProvider from @vercel/functions/oidc: no static keys, credentials derived from the deployment's OIDC identity and refreshed automatically. Read-write tokens are deliberately not accepted as S3 credentials.

Solution

New subpath export @vercel/blob/s3:

• blobS3Credentials(options?) returns a provider function for the AWS SDK's credentials option. Each call exchanges the Vercel OIDC token (VERCEL_OIDC_TOKEN or the oidcToken option, plus BLOB_STORE_ID or storeId) for temporary credentials through the new POST /blob/s3-credentials endpoint. It throws a clear error when no OIDC token is available, even if a read-write token is. Options: operations, pathname (scope) and durationMs (default 1 h, max 7 days).
• issueBlobS3Credentials() for a single credential set (for non-JS S3 clients). The result also carries endpoint, bucket and region so callers can configure a client without looking anything up.

const s3 = new S3Client({
  endpoint: 'https://public.blob.vercel-storage.com',
  region: 'auto',
  credentials: blobS3Credentials(),
});

No new dependencies; the credential type is structural so @aws-sdk/* stays out of the package. README documents the flow.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
vercel-storage-next-integration-test-suite	Ready	Preview	Sep 8, 2026 8:31pm UTC

[changeset-bot]

🦋 Changeset detected

Latest commit: bed448a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@vercel/blob	Minor
vercel-storage-integration-test-suite	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR