Trusted Sources for Deployment Protection
Deployment protection now accepts short-lived OIDC identity tokens from authorized Vercel projects and external services, eliminating the need to share long-lived secrets. Configure trusted sources with customizable from/to environment pairs to allow self-access, cross-project, and external OIDC provider authentication.
lets protected deployments accept from Vercel projects and external services you authorize, so you no longer have to share a long-lived secret. Trusted Sources is the recommended approach, but Protection Bypass for Automation continues to workTrusted Sourcesshort-lived identity tokens (OIDC)Protection Bypass for Automation
Callers attach an OIDC token in the header. Vercel then verifies the signature, checks the claims you configured, and confirms the environment matches the rule.x-vercel-trusted-oidc-idp-token
By default, the for a project can call its own deployments. To authorize another project in the same team, add it to Trusted Sources. Vercel OIDC token
Self-access and cross-project rules are both customizable with / environment pairs. To authenticate a request from a project, forward its Vercel OIDC token:fromto
Any custom OIDC provider can be authorized as a trusted external service, such as GitHub Actions, or a Vercel project in another team.
Read the to learn more.documentation
Authorize Vercel projects
Authorize external services
Source: original entry ↗
More from Vercel
Follow Vercel to get its new changes in your feed and email digest.
OpenAI Decisions API now available on AI Gateway
OpenAI's Decisions API is now accessible through Vercel's AI Gateway with an OpenAI-compatible endpoint, enabling decision models to answer typed questions and return probabilities, choices, and scores for routing, triage, and guardrails use cases. Support is available across the OpenAI SDK, AI SDK, HTTP API, and CLI with the latest versions.
Timestamp attributes now supported in Vercel Flags
Vercel Flags now supports timestamp attributes for entities, allowing you to create time-based targeting rules. Use this feature to run limited-time campaigns, show content between specific dates, or target users based on registration date.
Glyph Cluster now available in stealth on AI Gateway
Glyph Cluster, a reasoning model for coding and long-context analysis, is now available as a stealth model on Vercel's AI Gateway for Pro and Enterprise plan teams with purchased AI Gateway credits at no cost during the stealth period. The model supports function calling, streams responses, and can be accessed via AI SDK, OpenAI-compatible APIs, and coding agents.