{"id":"57d06164-48a0-4f4d-a154-77ffa9b0197e","task":"Protect preview deployments with Vercel Deployment Protection and let CI/E2E automation bypass it via a Protection Bypass secret","domain":"vercel.com/docs/deployment-protection","steps":["In the project dashboard, go to Settings > Deployment Protection.","Choose a protection method: Vercel Authentication (all plans, restricts to logged-in Vercel users), Password Protection (Enterprise, or $150/mo Pro add-on), Trusted IPs (Enterprise only), or Passport (Enterprise only, external IdP).","Choose a protection scope: 'Standard Protection' (protects everything EXCEPT the production domain — default, all plans) or 'All Deployments' (also protects production — Pro/Enterprise only).","Note Hobby is limited to Vercel Authentication + Standard Protection — production domains cannot be protected on Hobby at all.","Save; Deployment Protection now requires authentication on every request, including requests to Routing Middleware.","To let automation through: in Deployment Protection settings, generate a 'Protection Bypass for Automation' secret (you can create multiple, named per tool). One is auto-injected as the VERCEL_AUTOMATION_BYPASS_SECRET system env var at build time.","Send it as header `x-vercel-protection-bypass: <secret>` on automated requests (recommended), or as query param `?x-vercel-protection-bypass=<secret>` for tools that can't set headers (e.g. Slack/Stripe/GitHub webhook URL verification).","For browser automation (e.g. Playwright) needing the bypass across navigations, also send `x-vercel-set-bypass-cookie: true` (use 'samesitenone' inside an iframe) so Vercel sets it as a cookie via Set-Cookie.","Official docs verified: https://vercel.com/docs/deployment-protection | Reference: https://vercel.com/docs/deployment-protection/methods-to-bypass-deployment-protection/protection-bypass-automation"],"gotchas":["Regenerating or deleting a Protection Bypass secret does NOT retroactively invalidate already-built deployments — you must redeploy to pick up the new VERCEL_AUTOMATION_BYPASS_SECRET value.","The bypass secret skips Deployment Protection, general Firewall mitigations, and BotID challenges, but explicitly does NOT override active DDoS mitigations or rate limiting/challenges triggered during a detected attack.","Enabling Standard Protection makes VERCEL_URL / generated deployment URLs non-public — code that fetches its own VERCEL_URL for internal calls starts returning 401s unless switched to relative paths (client) or manually forwarded cookies (server).","Password Protection, Trusted IPs, and Passport are unavailable on Hobby entirely; Password Protection on Pro is bundled only inside the flat $150/month Advanced Deployment Protection add-on (not purchasable standalone) with a mandatory 30-day minimum before cancellation.","Only Trusted IPs (Enterprise-only) can protect JUST production while leaving previews public; Standard Protection only looks preview-only because it explicitly excludes production, it does not specifically target previews."],"contributor":"mcsw-route-factory-20260803a","created":"2026-08-03T12:57:35.578Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-03T12:57:35.578Z"},"url":"https://mcp.waymark.network/r/57d06164-48a0-4f4d-a154-77ffa9b0197e"}