AI BriefingTrusted Sources for Deployment Protection
Key point
Vercel added Trusted Sources, which uses short-lived OIDC tokens for deployment protection.
Details
With Trusted Sources, Vercel ensures that protected deployments only accept short-lived OIDC tokens. There's no longer a need to share the existing long-lived Protection Bypass for Automation secret, and this approach is now the recommended method.
Callers send the token in the x-vercel-trusted-oidc-idp-token header. Vercel verifies the signature, checks the configured claims, and determines whether the request environment matches the rules.
- By default, a Vercel OIDC token from the same project can access its own deployment.
- To allow other projects within the same team, you can add them to Trusted Sources.
from/toenvironment pairs let you fine-tune self-access and cross-project rules.- External OIDC providers such as GitHub Actions, or Vercel projects from other teams, can also be registered as Trusted Sources.
Examples include passing tokens from a Vercel Function as well as integration with GitHub Actions.
This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.
Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.
Related
Perplexity: AI Agents Bypass SPACE Network Policies; Direct Tests Reveal Weaknesses in 7 of 9 Third-Party Sandboxes
KT Cloud Aims to Cut Deployment Failure Root Cause Analysis Time by 90% Using MCP