Bypass Deployment Protection for testing, sharing, and automation

Deployment Protection secures your deployments, but sometimes you need to grant access for testing, sharing, or automation. You can bypass protection selectively while keeping your overall security intact.

• Trusted Sources: Let other Vercel projects or external services reach this project's protected deployments by presenting an OIDC token

• Protection Bypass for Automation: Use a secret to bypass protection features for all deployments in a project, such as for end-to-end (E2E) testing
• OPTIONS Allowlist: Specify paths to be unprotected for CORS preflight OPTIONS requests
• Deployment Protection Exceptions: Specify preview domains that should be exempt from deployment protection
• Shareable Links: Enable external users to access specific branch deployments by appending a secure query parameter to the URL

With Trusted Sources you can allow other Vercel projects or external services such as GitHub Actions to reach this project's protected deployments. Each caller authenticates by attaching a short-lived OIDC token, so you don't need to share a secret or open the deployment to the public.

The setting groups callers as Vercel Projects (other projects in the same team, with this project pinned for self-access) and External Services (non-Vercel workloads that present a token from their own identity provider). By default, access is limited to matching environments. You can define custom access rules to expand or restrict this.

Learn more about Trusted Sources, and how to add and remove them.

For automated tasks like end-to-end (E2E) testing and third-party webhook integrations, you can use Protection Bypass for Automation. When enabled, it generates a secret that can be used as a System Environment Variable (VERCEL_AUTOMATION_BYPASS_SECRET) or as a query parameter in URLs to bypass protection features for all deployments in a project.

You can provide the bypass secret in two ways:

• As an HTTP header (recommended for testing tools): x-vercel-protection-bypass: your-secret
• As a query parameter (required for webhook URLs): ?x-vercel-protection-bypass=your-secret

Common use cases for Protection Bypass for Automation include:

• E2E tests that run on protected deployments
• Slack bot webhook verification and events
• Third-party webhook services (Stripe, GitHub, etc.) that cannot set custom headers

Learn more about Protection Bypass for Automation, and how to enable and disable it.

With OPTIONS Allowlist you can specify paths to be unprotected for preflight OPTIONS requests. This can be used to enable CORS preflight requests to your project's protected deployments, as browsers do not send authentication on preflight requests.

Vercel compares incoming request paths against the paths in the allowlist. If a request path starts with one of the specified paths and has the method OPTIONS, it bypasses Deployment Protection.

For example, if you specify /api, all requests to paths that start with /api (such as /api/v1/users and /api/v2/projects) will be unprotected for any OPTIONS request.

Learn more about OPTIONS Allowlist.

With Deployment Protection Exceptions you can specify preview domains that should be exempt from deployment protection. Adding a domain to Deployment Protection Exceptions makes it publicly accessible, bypassing features like Vercel Authentication, Password Protection, and Trusted IPs.

For example, if you add preview-branch-name.vercel.app to Deployment Protection Exceptions, this domain becomes publicly accessible, bypassing the project's deployment protection settings. When removed, it reverts to the default protection settings.

Learn more about Deployment Protection Exceptions, and how to add and remove domains.

Shareable Links allow external access to specific branch deployments through a secure query parameter. Users with this link can see the latest deployment and leave comments (if enabled and logged in with their Vercel account).

For example, if you generate a Shareable Link for the feature-new-ui branch, users with this link can view the latest deployment and comment.

Learn more about Shareable Links, and how to generate and revoke them.

• Understanding Deployment Protection by environment
• Methods to protect deployments