telexed ~ c / f082ed29-79aradar:70 · infra_saasLIVE
← back
NO.
#f082ed29
Topic
INFRA & SAAS
Source
vercel_blog
Published
2026-05-13 00:00:00
Importance
★ 7/10 — radar 70
`Vercel` adds `Trusted Sources` to Deployment Protection
FIG-0081:1

`Vercel` adds `Trusted Sources` to Deployment Protection

Short-lived OIDC tokens can now replace shared bypass secrets for protected deployments. Safer CI and cross-project calls with less secret sprawl; worth adopting now.

[ KEY POINTS ]
  1. Requests now pass an OIDC token in x-vercel-trusted-oidc-idp-token; Vercel verifies signature, claims, and env match before allowing access.
  2. A project can access its own deployments by default, and same-team cross-project access is allowed by adding explicit source rules.
  3. Rules are configurable per from / environment pair, so preview, staging, and production access can be split cleanly.
  4. External identity providers are supported too, including GitHub Actions; one-off automation no longer needs a long-lived shared bypass secret.
Originalvercel.com/changelog/trusted-sources-for-deployment-protectionRead original →

// related