# Access Protected Vercel Deployment > Access and test Vercel deployments protected by Vercel Authentication, SSO, or Deployment Protection. Use when curl, agent-browser, Playwright, or another automated request reaches a Vercel login or protection page; when a protected preview or production URL returns 401 or 403; when TRUSTED_SOURCES_ENVIRONMENT_MISMATCH appears; or when choosing between `vercel curl` and the `x-vercel-trusted-oidc-idp-token` header. Fuente: https://skillsagentes.com/skills/vercel/vercel-plugin/access-protected-vercel-deployment Markdown: https://skillsagentes.com/skills/vercel/vercel-plugin/access-protected-vercel-deployment.md Repositorio: https://github.com/vercel/vercel-plugin Autor: vercel Licencia: NOASSERTION Actualizado: hace 25 días Coste de contexto: 105 tok instalada, 1.9k tok al activarse, 1.9k tok con todos los archivos del bundle Bundle: 1 archivo, 7 KB Permisos que pide: ninguno declarado ## Instalación Un skill son archivos markdown: los mismos archivos valen para cualquier agente y lo único que cambia es el directorio de destino, es decir la bandera `--agent`. Añade `-g` para instalarlo en todos los proyectos de la máquina. ```bash # Claude Code npx -y skills add vercel/vercel-plugin --skill access-protected-vercel-deployment --agent claude-code # Cursor npx -y skills add vercel/vercel-plugin --skill access-protected-vercel-deployment --agent cursor # Codex npx -y skills add vercel/vercel-plugin --skill access-protected-vercel-deployment --agent codex # Gemini CLI npx -y skills add vercel/vercel-plugin --skill access-protected-vercel-deployment --agent gemini # Windsurf npx -y skills add vercel/vercel-plugin --skill access-protected-vercel-deployment --agent windsurf # Cline npx -y skills add vercel/vercel-plugin --skill access-protected-vercel-deployment --agent cline ``` ## Antes de instalar - Variables de entorno: VERCEL_OIDC_TOKEN - makes network requests - needs API credentials ## Archivos - SKILL.md — 7 KB ## SKILL.md Reproducido tal cual desde vercel/vercel-plugin bajo NOASSERTION. Esta sección es el documento original y está en inglés. # Access Protected Vercel Deployments Use the caller's existing Vercel authentication. Do not disable Deployment Protection or ask for a long-lived bypass secret as the first solution. ## Choose the access path ### HTTP requests: use `vercel curl` For response bodies, headers, health checks, and API calls, replace raw `curl` with `vercel curl` (`vc curl`). It accepts native curl options and uses Vercel authentication to access protected preview and production deployments. ```bash vc curl https://my-app.vercel.app/api/health vc curl https://app.example.com/api/health vc curl my-app.vercel.app/api/users -X POST \ -H "Content-Type: application/json" \ -d '{"name":"Ada"}' vc curl /api/health ``` The path-only form targets the linked project's production deployment. Pass a full URL when the exact deployment matters. If authentication fails, check the local identity and project before changing protection settings: ```bash vc whoami ``` Inspect `.vercel/project.json` to confirm the linked project and team. Run `vc link` only when the directory is not linked or is linked to the wrong project. Run `vc login` only when the CLI reports that no authenticated user is available. ### Browser automation: attach the development OIDC token as a header Browser requests must include the short-lived local token as a request header: ```text x-vercel-trusted-oidc-idp-token: ``` Use a browser tool that supports origin-scoped request headers. With `agent-browser`, inject development variables without printing or persisting the token: ```bash vc env run -- sh -c \ 'test -n "$VERCEL_OIDC_TOKEN" && agent-browser open "$1" --headers "{\"x-vercel-trusted-oidc-idp-token\":\"$VERCEL_OIDC_TOKEN\"}"' \ sh https://my-app.vercel.app ``` Then continue the normal browser workflow in the same session. For Playwright or another browser driver, set the same header in the browser context's extra HTTP headers before the first navigation. If the local CLI version does not provide the token through `vc env run`, refresh local development credentials with: ```bash vc env pull .env.local --yes ``` Load the file through the project's existing dotenv mechanism. Never print the token, paste its value into source code, or commit `.env.local`. Use `x-vercel-trusted-oidc-idp-token` for Trusted Sources. Do not substitute `x-vercel-oidc-token`; that header carries an OIDC token into a Vercel Function and serves a different purpose. ## Trusted Sources rules A local development token for a linked Vercel project can access that same project's Preview deployments by default. It does not automatically access protected Production deployments. For protected Production, the project's own Trusted Sources entry must allow `development` → `production`. Do not ask the user to configure Trusted Sources for the normal same-project Preview case. Configuration is needed when: - the target is a protected Production deployment and the caller uses a local development token; - the caller belongs to another Vercel project or team; - the target project's self-access rules were customized; or - the response is `TRUSTED_SOURCES_ENVIRONMENT_MISMATCH`. In the target project, open **Settings → Deployment Protection → Trusted Sources**. Add or edit the caller and allow the required `from` → `to` environment pair. A local token has the `development` environment, so access to protected Production requires `development` → `production`. Treat this as an access-control change: explain the exact rule required and obtain authorization before changing it. Do not broaden unrelated environment pairs. ## Diagnose the response - A Vercel login, SSO, or Deployment Protection page means the request did not use an accepted authentication path. - `TRUSTED_SOURCES_ENVIRONMENT_MISMATCH` means the token is valid but its caller environment is not allowed to reach the target environment. - An application-generated `401` or `403` after Vercel protection is bypassed belongs to the application's own authentication and must be debugged separately. - A deployment marked `"target": "production"` can still be protected. Do not assume production is public. ## Avoid - Do not disable Deployment Protection to make automation pass. - Do not send raw unauthenticated `curl` repeatedly after receiving the protection page. - Do not start an interactive SSO browser login when `vc curl` or an origin-scoped OIDC header can authenticate the request. - Do not expose `VERCEL_OIDC_TOKEN` in logs, screenshots, committed files, or user-facing output. ## Related skills - General Vercel CLI usage: `⤳ skill: vercel-cli` - End-to-end application verification: `⤳ skill: verification` ## Dónde encaja - Categoría: [Herramientas para desarrolladores](https://skillsagentes.com/categorias/herramientas-desarrollo.md) — Skills que cambian cómo tu agente escribe, revisa y despliega código. - Creador: [vercel](https://skillsagentes.com/creators/vercel.md) — 79 skills en el directorio - [Todas las skills](https://skillsagentes.com/skills.md) - [Ranking de instalaciones](https://skillsagentes.com/ranking.md) ## Otras skills del mismo repositorio - [Vercel Connect](https://skillsagentes.com/skills/vercel/vercel-plugin/vercel-connect.md): Vercel Connect expert guidance — securely obtain scoped OAuth tokens for third-party services (Slack, GitHub, MCP servers, OAuth, Snowflake) on behalf of apps or users via Vercel OIDC. Use when wiring up third-party API access, connecting to MCP servers, sending Slack messages, accessing GitHub APIs, receiving webhook events from Slack/Linear/GitHub and forwarding them to your agents and apps, or building eve agent connections. - [Knowledge Update](https://skillsagentes.com/skills/vercel/vercel-plugin/knowledge-update.md): Corrects outdated LLM knowledge about the Vercel platform and introduces new products. Injected at session start. - [Cdn Caching](https://skillsagentes.com/skills/vercel/vercel-plugin/cdn-caching.md): Debug Vercel CDN caching — cache hit rate, stale content, revalidation behavior, ISR + PPR, per-request cache reasons (cacheReason) and PPR state (ppr_state), and costs. - [Vercel Functions](https://skillsagentes.com/skills/vercel/vercel-plugin/vercel-functions.md): Vercel Functions expert guidance — Serverless Functions, Edge Functions, Fluid Compute, streaming, Cron Jobs, and runtime configuration. Use when configuring, debugging, or optimizing server-side code running on Vercel. - [Create A Backend](https://skillsagentes.com/skills/vercel/vercel-plugin/create-a-backend.md): Backend architecture guidance. Use when planning, building, or migrating an API or backend; choosing between Functions, Services, containers, Workflow, Queues, and Marketplace databases; or selecting a supported backend framework or runtime. ## Skills relacionadas - [Benchmark Sandbox](https://skillsagentes.com/skills/vercel/vercel-plugin/benchmark-sandbox.md): Run vercel-plugin eval scenarios in Vercel Sandboxes instead of local WezTerm panels. Provisions ephemeral microVMs with Claude Code + plugin pre-installed, runs benchmark prompts, extracts hook artifacts, and produces coverage reports. - [Release](https://skillsagentes.com/skills/vercel/vercel-plugin/release.md): Release vercel-plugin — run gates, bump version, generate artifacts, commit, and push. Use when asked to "release", "ship", "bump and push", or "cut a release". - [Ai Gateway](https://skillsagentes.com/skills/vercel/vercel-plugin/ai-gateway.md): Vercel AI Gateway expert guidance. Use when configuring model routing, provider failover, cost tracking, or managing multiple AI providers through a unified API. - [Ai Sdk](https://skillsagentes.com/skills/vercel/vercel-plugin/ai-sdk.md): Vercel AI SDK expert guidance. Use when building AI-powered features — chat interfaces, text generation, structured output, tool calling, agents, MCP integration, streaming, embeddings, reranking, image generation, or working with any LLM provider. - [Build Agents](https://skillsagentes.com/skills/vercel/vercel-plugin/build-agents.md): Default guidance for building AI agents. Use for generic requests to build, create, scaffold, design, architect, or implement an AI agent, agent app, tool-calling agent, durable agent, multi-agent system, or scheduled agent. --- Skills Agentes · [Índice de páginas en markdown](https://skillsagentes.com/sitemap.md) · [Inicio](https://skillsagentes.com/index.md)