Vercel Passport now generally available

is now generally available.Vercel Passport

Passport allows you to protect your Vercel deployments with your own identity provider. Visitors authenticate through Okta, Microsoft Entra ID, or any OIDC provider before viewing a protected deployment, and Vercel forwards a signed identity token to the deployment so application code can build on who the visitor is.

The helper in reads the Vercel request context and returns the authenticated visitor. Vercel strips client-supplied values for the header and injects the verified token after Passport validates the session, so the identity your code receives is already verified.getIdentity()@vercel/passportx-vercel-oidc-passport-token

The field is a stable identifier for the visitor, scoped to your team and the application that links Passport to your identity provider, and is the visitor's ID in the provider itself. The helper returns only when a request arrives without a Passport session, because unauthenticated browser visitors are redirected to the identity provider before they ever reach your code.subjectexternalSubjectnullVercel Connect

In local development, returns a configurable , so the same code path works without a real identity provider.getIdentity()development identity

The signed Passport token can now carry additional identity claims from your provider, such as group membership. Request the scope and allowlist the claim in the Vercel Connect application that Passport uses, then read it from the identity payload:groups

The covers provider configuration, including a full Okta walkthrough.additional identity scopes documentation

Forward the Passport token from your application to another backend as a bearer token and verify it there with , available in 1.0.0 and later. The helper checks the token signature, the Passport claims, and that the token came from the expected project and environment:verifyIdentity()@vercel/passport

Services outside JavaScript can verify the token as a standard JWT with the published . Learn more in the .JWKSverify identity documentation

Every successful Passport authentication records a event in both the and , identifying the visitor and recording the protected hostname and project. The Activity Log view is already filtered to Passport access.passport-access-grantedActivity LogAudit Logs

now applies to Passport. Webhooks, cron jobs, and CI runs that already send a bypass secret in the header or query parameter keep working when you turn Passport on. Because Passport runs in Vercel's network before your deployment's routes and proxy functions, the secret has to be part of the original request rather than added by your own middleware. A bypassed request has no signed-in visitor, so returns .Protection Bypass for Automationx-vercel-protection-bypassgetIdentity()null

offers the same bypass without a shared secret. Protected deployments accept short-lived OIDC tokens from the Vercel projects and external services you authorize, which is how the workflow that triggers from Slack reaches a Passport-protected deployment.Trusted Sourceseve

Passport now supports , so deployments in an environment like or get the same identity provider sign-in as your preview and production deployments.custom environmentsstagingqa

Vercel Passport is available on the . New guides cover , , local development, , and bypassing Passport for automation.Enterprise planidentity provider setuptoken claimsforwarding identity between backends

Set up Passport with your identity provider in the , or configure it programmatically through the .Passport documentationVercel API

Read more

Read visitor identity in application code

Authorize with groups from your identity provider

Verify identity in downstream services

Monitor Passport access

Bypass Passport for automated traffic

Bypass Passport with Trusted Sources

Protect custom environments

Get started