Agent skill · vercel-labs
protected-vercel-deployments
Access and test Vercel deployments protected by Vercel Authentication, SSO, or Deployment Protection with agent-browser. Use when a preview or production URL redirects to a Vercel login page, returns a protection 401 or 403, or needs short-lived Trusted Sources OIDC authentication instead of a static bypass secret or public exception.
What it needs
About 4k tokens when loaded.
What this skill does
Protected Vercel deployments Use the caller's existing Vercel identity and a short-lived OIDC token. Do not disable Deployment Protection, make the deployment public, or ask for a static bypass secret first. Same-project preview A local development token for the target project can access that project's protected Preview deployments through the default Trusted Sources self-access rule. No Trusted Sources configuration is normally required. Confirm the local identity and Vercel CLI version: Require Vercel CLI 53.3.0 or newer before running vc project token. Versions 50.25.0 through 53.2.x write the token to stderr, so command substitution captures nothing and the credential can appear in logs. If the installed version is older, stop and ask the user to upgrade it. Do not attempt to capture or recover the token from stderr. Set the target project and scope explicitly. If they cannot be inferred safely, ask the user. In a directory whose existing .vercel/project.json link has been verified against the target, vc project token without a project name is also valid. Do not run vc link merely to get an OIDC token: current Vercel CLI versions also pull development variables into .env.local when linking. Create a named browser session, mint a development OIDC token with the Vercel CLI, then inject it without printing or persisting it: Continue the normal workflow in that same session. The header is scoped to the target origin and applies to the document, scripts, styles, fonts, and in-page requests. If the browser session is closed or restarted, repeat the authenticated open command. Never print the token, paste it into source, or save it in an environment file. Other environments and callers Trusted Sources configuration is needed when: a local development token must reach a protected Production deployment; the caller belongs to another Vercel project or team; the target project's self-access rules were customized; or Vercel returns TRUSTEDSOURCESENVIRONMENTMISMATCH. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills vercel-labs/protected-vercel-deployments