Access tokens

Vercel access tokens authenticate requests to the Vercel REST API and the Vercel CLI on your behalf. You create and manage them on the Account Tokens page, under the Settings area of your account, and you can also create them without the dashboard using the REST API or the CLI.

A token's value appears only once, at creation, so copy it then and store it somewhere secure because you cannot retrieve it again afterward. Every token carries a scope that determines which resources it can reach. This page explains the three scoping levels and walks through creating a project-scoped token, which limits a token to a single project.

When you create a token, you choose how far its access reaches. Vercel supports three levels:

A project-scoped token denies any request to another project, to a user-level resource, or to a team-level resource. This keeps jobs, tools, and workflows constrained to the projects they need rather than granting them the entire team or your full account.

Create a Vercel API access token from your personal account's Account Tokens page:

1. Enter a descriptive token name.
2. Open Scope and choose the resources the token needs. Select Full Account for personal account access, or select a team to limit access to that team. If the team opens a project list, select All Projects for team access or an individual project for project access.
3. Choose an expiration and select Create.
4. Copy the token and store it securely. Vercel shows the value only once.

Choose the narrowest scope that supports your task. For a walkthrough of project access, see Project-scoped access token.

This section covers creating a project-scoped access token from the dashboard.

• A Vercel account.
• Membership in the team that owns the project you want to scope the token to.
• Two-factor authentication enabled on your account, if the target team requires it.

1. Open the Account Tokens page

   In the scope selector at the top left of the dashboard's navigation bar, make sure you are viewing your personal account rather than a team. Then go to the Account Tokens page, also found under the Settings area of your account.

2. Name the token

   Enter a descriptive name for the token so you can identify it later.

3. Select the team

   Open the Scope dropdown and select the team that owns the project. Clicking the team drills into its list of projects.

4. Select the project

   Select the project you want the token to be limited to.

   Selecting All Projects instead of an individual project creates a team-scoped token rather than a project-scoped one.

5. Choose an expiration and create the token

   Choose an expiration and select Create.

6. Copy the token

   Copy the token now. Personal access tokens begin with the prefix vcp_, and the value will not be shown again.

Pass the token as a Bearer token in the Authorization header of your request.

curl "https://api.vercel.com/v9/projects" \
  -H "Authorization: Bearer vcp_xxxxxxxxxxxxxxxxxxxxxxxx"

Listing projects with a scoped access token

Team- and project-scoped tokens do not require the teamId query parameter or the team slug on API requests. Vercel infers the team and project from the token's scope, so you can omit those parameters. Full-account tokens still need ?teamId= when targeting a specific team's resources.

To list deployments, send a request to GET /v7/deployments. Store your token in the VERCEL_ACCESS_TOKEN environment variable, then run:

curl "https://api.vercel.com/v7/deployments" \
  -H "Authorization: Bearer $VERCEL_ACCESS_TOKEN"

The response contains a deployments array and pagination information. A full-account token targets your personal account by default. A team- or project-scoped token targets the resources in its scope.

For a full-account token targeting a team, set VERCEL_TEAM_ID to the team's ID from team settings, then include teamId in the request:

curl "https://api.vercel.com/v7/deployments?teamId=$VERCEL_TEAM_ID" \
  -H "Authorization: Bearer $VERCEL_ACCESS_TOKEN"

You can also make the request from server-side JavaScript:

const url = new URL('https://api.vercel.com/v7/deployments');
if (process.env.VERCEL_TEAM_ID) {
  url.searchParams.set('teamId', process.env.VERCEL_TEAM_ID);
}
 
const response = await fetch(url, {
  headers: {
    Authorization: `Bearer ${process.env.VERCEL_ACCESS_TOKEN}`,
  },
});
 
if (!response.ok) {
  throw new Error(`Vercel API request failed: ${response.status}`);
}
 
const { deployments } = await response.json();
console.log(deployments);

This prints the deployments accessible to the token and selected team. Keep the token in server-side environment variables rather than client-side code.

You can create tokens without the dashboard through two paths.

• REST API, where the create an auth token endpoint accepts an optional projectId in the request body to scope the token to a project.
• Vercel CLI, where vercel tokens manages tokens from the command line. Use vercel tokens add --project <PROJECT_ID> to create a project-scoped token.

• Vercel REST API authentication
• Managing tokens with the Vercel CLI
• Create an auth token API endpoint
• Account Management