`Vercel` adds `Trusted Sources` to Deployment Protection
Short-lived OIDC tokens can now replace shared bypass secrets for protected deployments. Safer CI and cross-project calls with less secret sprawl; worth adopting now.
- Requests now pass an
OIDCtoken inx-vercel-trusted-oidc-idp-token;Vercelverifies signature, claims, and env match before allowing access. - A project can access its own deployments by default, and same-team cross-project access is allowed by adding explicit source rules.
- Rules are configurable per
from/ environment pair, so preview, staging, and production access can be split cleanly. - External identity providers are supported too, including
GitHub Actions; one-off automation no longer needs a long-lived shared bypass secret.