Restrict access to production source maps

Protected Source Maps gates requests for browser source maps behind Vercel Authentication. When enabled, your deployment serves .map files only to users who can already access the deployment, and returns 404 Not Found to everyone else.

This lets you ship source maps to production so your team and error trackers can read meaningful stack traces, without exposing your source code to the public.

To get started, enable Protected Source Maps from your project's Deployment Protection settings, then use the Vercel Toolbar to view protected source maps in your browser.

You can manage Protected Source Maps from the dashboard or the REST API. Either way, access is limited to the users listed below.

The same users who can view your protected deployments can view their source maps:

• Logged-in team members with at least a viewer role
• Logged-in project members with at least the project Viewer role
• Logged-in members of an access group that has access to the project
• Users who have been granted access to the deployment
• Tools using the protection bypass for automation header

1. Go to project deployment protection settings

   From your Vercel dashboard:

   1. Select the project you want to configure
   2. Open Settings in the sidebar and select Deployment Protection

2. Toggle Protected Source Maps

   From the Protected Source Maps section:

   1. Use the toggle to enable or disable the feature
   2. Select Save

   The change applies to your existing deployments on the next request for a .map file. There is no need to redeploy.

Use the Vercel API endpoint to update an existing project with the protectedSourcemaps boolean field.

curl -X PATCH "https://api.vercel.com/v9/projects/your_project_id_here?teamId=your_team_id_here" \
  -H "Authorization: Bearer your_access_token_here" \
  -H "Content-Type: application/json" \
  -d '{"protectedSourcemaps": true}'

Set protectedSourcemaps to false in the body to disable the feature.

Browsers do not send your Vercel session with .map requests by default, so DevTools and other tools cannot load protected source maps until they authenticate against the deployment. The Vercel Toolbar signs the browser in for the current deployment.

To view protected source maps in your browser:

1. Open the deployment you want to inspect
2. Activate the Vercel Toolbar and sign in with an account that has access to the deployment
3. Turn on Debug Mode in the Toolbar Menu
4. Reload the page

Your browser DevTools resolves minified stack traces using the protected source maps. Access is scoped to the deployment URL it was issued for, and ends when you sign out of Vercel or close the Toolbar session.

When a browser requests a .map file from your deployment, Vercel checks the project's protectedSourcemaps setting before serving the response:

• If protectedSourcemaps is true, Vercel checks the request against deployment protection and serves the source map to authorized users. Everyone else receives a 404 Not Found response, which avoids confirming whether the file exists at the requested path.
• If protectedSourcemaps is false, the deployment serves source maps to anyone who requests them. This preserves the behavior of projects that intentionally publish source maps for public error tracking.

This protection applies to browser source maps generated during a build, such as *.js.map and *.css.map. It does not change how source maps are generated, uploaded to error trackers, or consumed in non-browser contexts.

• Vercel Authentication
• Vercel Toolbar
• Methods to bypass Deployment Protection
• NEXTJS_NO_PRODUCTION_SOURCE_MAPS conformance rule