Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →vercel-labs/protected-vercel-deployments
Access and test Vercel deployments protected by Vercel Authentication, SSO, or Deployment Protection with agent-browser.
Passed 19 of 21 test cases with the skill, and 12 of 21 without it.
and 9 more in the full report
8 fixed13 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
I am writing an automated browser test for our Vercel preview deployment and I'm passing `x-vercel-oidc-token: <TOKEN>` in the request headers to bypass deployment protection, but it keeps redirecting to the Vercel login page. Which exact HTTP header name should be used to authenticate through Deployment Protection?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies x-vercel-trusted-oidc-idp-token as the required HTTP header | Missed | Passed |
| Explains that x-vercel-oidc-token is used for function workload identity | Missed | Passed |
The instructions your model reads when the skill loads.
Use the caller's existing Vercel identity and a short-lived OIDC token. Do not disable Deployment Protection, make the deployment public, or ask for a static bypass secret first.
A local development token for the target project can access that project's protected Preview deployments through the default Trusted Sources self-access rule. No Trusted Sources configuration is normally required.
Confirm the local identity and Vercel CLI version:
vc whoami
vc --version
Require Vercel CLI 53.3.0 or newer before running vc project token. Versions 50.25.0 through 53.2.x write the token to stderr, so command substitution captures nothing and the credential can appear in logs. If the installed version is older, stop and ask the user to upgrade it. Do not attempt to capture or recover the token from stderr.
Set the target project and scope explicitly. If they cannot be inferred safely, ask the user. In a directory whose existing .vercel/project.json link has been verified against the target, vc project token without a project name is also valid. Do not run vc link merely to get an OIDC token: current Vercel CLI versions also pull development variables into .env.local when linking.
Create a named browser session, mint a development OIDC token with the Vercel CLI, then inject it without printing or persisting it:
export AGENT_BROWSER_SESSION="$(agent-browser session id --scope worktree --prefix vercel-preview)"
export VERCEL_PREVIEW_URL="https://my-app.vercel.app"
export VERCEL_PROJECT="my-app"
export VERCEL_SCOPE="my-team"
(
TOKEN="$(vc project token "$VERCEL_PROJECT" --scope "$VERCEL_SCOPE")"
test -n "$TOKEN"
agent-browser open "$VERCEL_PREVIEW_URL" --headers \
"{\"x-vercel-trusted-oidc-idp-token\":\"$TOKEN\"}"
)
agent-browser snapshot -i
Continue the normal workflow in that same session. The header is scoped to the target origin and applies to the document, scripts, styles, fonts, and in-page requests. If the browser session is closed or restarted, repeat the authenticated open command.
Never print the token, paste it into source, or save it in an environment file.
test cases passed, vs 12 / 21 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.