Trusted Sources for Deployment Protection
By Steven Van ·
Protected deployments can now trust other Vercel projects and services like GitHub Actions via short-lived OIDC tokens, on any plan.
Protected deployments on Vercel can now accept short-lived OIDC identity tokens from other Vercel projects and external services, instead of relying on a shared Protection Bypass for Automation secret. The feature is called Trusted Sources and is available on all plans. Protection Bypass for Automation still works, but Vercel now recommends Trusted Sources instead.
A caller attaches its OIDC token in an x-vercel-trusted-oidc-idp-token header, and Vercel checks the token's signature, the claims configured for that source, and whether the deployment's environment matches the rule before letting the request through.
- Other Vercel projects in the same team can be added to a project's Trusted Sources list. By default a project can only call its own deployments, but self-access and cross-project rules are both customizable with from/to environment pairs.
- External services that issue their own OIDC tokens, such as GitHub Actions or a Vercel project in another team, can also be authorized as trusted sources.