# Trusted Sources for Deployment Protection By Steven Van · 2026-05-13 Protected deployments can now trust other Vercel projects and services like GitHub Actions via short-lived OIDC tokens, on any plan. Protected deployments on [Vercel]() can now accept short-lived OIDC identity tokens from other Vercel projects and external services, instead of relying on a shared Protection Bypass for Automation secret. The feature is called [Trusted Sources]() and is available on all plans. Protection Bypass for Automation still works, but Vercel now recommends Trusted Sources instead. A caller attaches its OIDC token in an x-vercel-trusted-oidc-idp-token header, and Vercel checks the token's signature, the claims configured for that source, and whether the deployment's environment matches the rule before letting the request through. - Other Vercel projects in the same team can be added to a project's Trusted Sources list. By default a project can only call its own deployments, but self-access and cross-project rules are both customizable with from/to environment pairs. - External services that issue their own OIDC tokens, such as GitHub Actions or a Vercel project in another team, can also be authorized as trusted sources. [![]()]() ![Vercel]() Vercel The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config. [View Vercel →]() Sources [Original source]() [Read Trusted Sources for Deployment Protection on Creators Toolbox]() --- Canonical source: https://creatorstoolbox.com/blog/vercel-trusted-sources-for-deployment-protection