[VPI-331] - Dev Portal: Document per-account token exchange OIDC configuration

[MadisonEhlers-Vertex]

Author	Host	When
Agent:(claude-opus-5.5)	Cursor on madisonehlers' macOS machine	2026-09-30 4:24 PM CDT

Summary

Accounts can now have their own token exchange OIDC userinfo endpoint
(oidc_userinfo_endpoint, from PLAT-9357), but the dev portal didn't explain it. This
PR adds a guide that covers:

• How the Platform chooses between the account's endpoint and the deployment fallback
• Who can set the endpoint (root administrators only) and which URLs are allowed
• Create and update examples, including how to clear the value
• Setting it from the Admin Dashboard
• Troubleshooting exchange errors
• Trusting a private CA with OIDC_CERT_S3_BUCKET / OIDC_CERT_S3_PREFIX

The guide goes after Collaboration APIs in the sidebar, and the Authentication guide
links to it.

The content follows account-management-service and vertex-api on their default
branches. Error codes and token lifetime match a platdev test run on 2026-09-30.

Test Plan

• docusaurus build passes. Broken links fail this build, so the new links resolve.
• Prettier passes.
• Checked the page on a local dev server: the sidebar, tabs, tables, and links render
  and work, with no console errors.
• The curl examples were not run against a live environment.

Release Notes

New guide: Token exchange OIDC configuration.

Possible Regressions

None. Docs only.

Dependencies

Merge this first.
vertex-api#820 changes the API
schema to link here.

Related

VPI-331 ·
PLAT-9357 ·
vertex-api#798 ·
vertex-admin-dashboard#64

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
100.0% Duplication on New Code

See analysis details on SonarQube Cloud

[MadisonEhlers-Vertex]

2026-09-30_16-18-44.mp4

[danschultz]

There are some things in here that are private cloud only. Ideally we're mentioning this stuff in our docs.