skills.rest
sharad07072007
sharad07072007COMMUNITY
Explore all skills by this author →
GitHub

access-protected-vercel-deployment

Access Vercel deployments protected by authentication using vercel curl or OIDC token headers.

Updated Sep 10, 2026
Search Tags:#authentication#browser automation#vercel#sso#oidc#deployment protection#vercel curl
One-click install
npx skills add https://github.com/sharad07072007/paras --skill access-protected-vercel-deployment-sharad07072007
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: access-protected-vercel-deployment
Source: https://github.com/sharad07072007/paras/tree/main/.agents/plugins/vercel/skills/access-protected-vercel-deployment
Command: npx skills add https://github.com/sharad07072007/paras --skill access-protected-vercel-deployment-sharad07072007

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Automated requests to Vercel deployments protected by Vercel Authentication, SSO, or Deployment Protection fail with login pages, 401/403 responses, or TRUSTED_SOURCES_ENVIRONMENT_MISMATCH errors. This Skill shows how to authenticate those requests using the caller's existing Vercel credentials instead of disabling protection. ## Core Features & Use Cases - HTTP access with vercel curl: Replace raw curl with vc curl to fetch response bodies, headers, and health checks from protected preview and production deployments using Vercel CLI authentication. - Browser automation with OIDC headers: Inject the short-lived x-vercel-trusted-oidc-idp-token header into agent-browser or Playwright sessions so browser requests pass Trusted Sources checks. - Trusted Sources diagnosis: Interpret protection pages, 401/403 responses, and TRUSTED_SOURCES_ENVIRONMENT_MISMATCH to determine when a development → production Trusted Sources rule is required. - Use Case: A preview URL returns a Vercel SSO page when opened by agent-browser. Use this Skill to run the browser with the OIDC token header via vc env run and continue testing without touching protection settings. ## Quick Start Ask the agent to access your protected Vercel deployment URL, for example: "curl this protected Vercel deployment at https://my-app.vercel.app/api/health".

Frequently Asked Questions about access-protected-vercel-deployment

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I access a Vercel deployment protected by authentication?▼

Use `vercel curl` (or `vc curl`) instead of raw curl for HTTP requests; it authenticates with your existing Vercel CLI credentials. For browser automation, attach the `x-vercel-trusted-oidc-idp-token` header containing your local VERCEL_OIDC_TOKEN.

How do I open a protected Vercel preview in agent-browser or Playwright?▼

Inject the short-lived OIDC token as the `x-vercel-trusted-oidc-idp-token` request header. With agent-browser, run it through `vc env run` so VERCEL_OIDC_TOKEN is available; with Playwright, set the header in the browser context's extra HTTP headers before navigation.

What does TRUSTED_SOURCES_ENVIRONMENT_MISMATCH mean on Vercel?▼

It means your token is valid but its caller environment is not allowed to reach the target environment. A local development token accesses same-project Preview deployments by default, but protected Production requires a Trusted Sources rule allowing `development` → `production`.

Why does curl return a Vercel login page or 401/403 on my deployment?▼

A Vercel login, SSO, or protection page means the request used no accepted authentication path. Replace raw curl with `vc curl`, and verify identity with `vc whoami` and the linked project in `.vercel/project.json` before changing any protection settings.

Can I use x-vercel-oidc-token instead of x-vercel-trusted-oidc-idp-token?▼

No. The `x-vercel-trusted-oidc-idp-token` header is for Trusted Sources access to protected deployments, while `x-vercel-oidc-token` carries an OIDC token into a Vercel Function and serves a different purpose.

Should I disable Vercel Deployment Protection to run automated tests?▼

No. Disabling Deployment Protection weakens access control and is unnecessary. Use `vc curl` for HTTP requests or an origin-scoped OIDC header for browsers, and only adjust Trusted Sources rules with explicit authorization when cross-environment access is required.

Related Skills

Explore More Software Engineering Skills→
nrminornrminor

vcs-detect

Detect whether a project uses jj or git for version control.

Community
Basic
ollieb89ollieb89

netlify-deploy

Automates Netlify deployments including authentication, linking/creating sites, previews and production via CLI or netlify.toml settings.

Community
Advanced
vercel-labsvercel-labs
41.7k

protected-vercel-deployments

Access Vercel deployments protected by Deployment Protection using short-lived OIDC tokens.

Official
Advanced
Jaush-MJaush-M

better-auth-security-best-practices

Enforce rate limiting, secret handling, and CSRF protection for Better Auth deployments.

Community
Advanced