Restrict deployment access by IP address

With Trusted IPs enabled at the level of your project, only visitors from an allowed IP address can access your deployment. The deployment URL will return 404 No Deployment Found for all other requests. Trusted IPs is configured by specifying a list of IPv4 addresses and IPv4 CIDR ranges.

Trusted IPs works well if you access Vercel deployments through a specific IP address. For example, you can limit preview deployment access to your VPN. You can also enable Trusted IPs in production to restrict incoming access to only requests through your external proxy.

The tables below outline key considerations and security implications when using Trusted IPs for your deployments on Vercel.

Vercel Firewall provides observable and customizable IP-based access control. You can test rules with the Log action, inspect matching traffic, manage larger IP allowlists by adding addresses directly to rules or reusable team Lists, combine IP addresses with other request conditions, and reuse policies across teams and projects.

Migration is optional.

To move an existing Trusted IPs configuration to Vercel Firewall:

1. Keep Trusted IPs enabled while you configure and test the Firewall rule.
2. Record the IPv4 addresses and CIDR ranges in the project's Trusted IPs settings.
3. Review which IP address Vercel Firewall evaluates before copying the allowlist. If an external proxy connects to Vercel, the behavior differs:
   • Trusted IPs: Checks the IP that connects directly to Vercel. With an external proxy, this is the proxy IP, even when Verified Proxy Advanced is configured.
   • Firewall with Verified Proxy Advanced: Checks the forwarded end-user IP. If the Trusted IPs allowlist contains proxy IPs, copying it won't preserve the same access.
   • Firewall without Verified Proxy Advanced: Checks the IP that connects directly to Vercel. With an external proxy, this is the proxy IP. Review the full proxy behavior and forwarding-header alternative before creating the rule.
4. Follow Set up trusted IP access with Vercel Firewall. Add the recorded addresses directly to a Shared Rule or Project Custom Rule, or store them in a reusable team List.
5. Use the mapping in Match the Trusted IPs deployment scope to add the Domain Environment condition.
6. Complete the Log and Deny tests.
7. Open the project's Deployment Protection settings and disable Trusted IPs.
8. Select Save, then repeat the allowed and unlisted IP tests.

Firewall Deny returns 403 Forbidden, while Trusted IPs returns 404 No Deployment Found.

Use these Firewall conditions to reproduce the current Trusted IPs scope:

The Environment Equals Preview condition preserves the legacy Pre-Production Deployments scope. For new configurations, we recommend the Standard Protection mapping, which also protects past Production Deployments and Production Deployment URLs.

You can manage Trusted IPs through the dashboard, API, or Terraform.

1. Go to project deployment protection settings

   From your Vercel dashboard:

   1. Select the project that you wish to enable Trusted IPs for
   2. Go to Deployment Protection in the sidebar

2. Manage Vercel Authentication

   Ensure Vercel Authentication is enabled. See Managing Vercel Authentication.

3. Manage Trusted IPs

   From the Trusted IPs section:

   1. Use the toggle to enable the feature
   2. Select the deployment environment you want to protect
   3. Enter your list of IPv4 addresses and IPv4 CIDR ranges with an optional note describing the address
   4. Finally, select Save

   All your existing and future deployments will be protected with Trusted IPs for that project. Visitors to your project deployments from IP addresses not included in your list will see a No Deployment Found error page.

You can manage Trusted IPs using the Vercel API endpoint to update an existing project with the following body:

To enable or update Trusted IPs, send the trustedIps object:

{
  "trustedIps": {
    "deploymentType": "all",
    "addresses": [{ "value": "203.0.113.0/24", "note": "Office network" }],
    "protectionMode": "additional"
  }
}

To disable Trusted IPs, set trustedIps to null:

{
  "trustedIps": null
}

You can configure Trusted IPs using trusted_ips in the vercel_project data source in the Vercel Terraform Provider.