OPTIONS Allowlist

Learn how to disable Deployment Protection for CORS preflight requests for a list of paths.
Table of Contents

OPTIONS Allowlist is available on all plans

You can use OPTIONS Allowlist to disable Deployment Protection (including Vercel Authentication, Password Protection, and Trusted IPs) on any incoming CORS preflight OPTIONS request for a list of paths.

When you add a path to OPTIONS Allowlist, any incoming request with the method OPTIONS that starts with the path will no longer be covered by Deployment Protection. When you remove a path from OPTIONS Allowlist, the path becomes protected again with the project's Deployment Protection settings.

For example, if you specify /api, all requests to paths that start with /api (such as /api/v1/users and /api/v2/projects) will be unprotected for any OPTIONS request.

OPTIONS Allowlist.
OPTIONS Allowlist.
  1. From your Vercel dashboard:

    1. Select the project that you wish to enable Password Protection for
    2. Go to the Settings tab, and then to Deployment Protection
  2. From the OPTIONS Allowlist section, enable the toggle labelled Disabled:

  3. Specify a path to add to the OPTIONS Allowlist:

  4. To add more paths, select Add path:

  5. Once all the paths are added, select Save

  1. From your Vercel dashboard:

    1. Select the project that you wish to enable Password Protection for
    2. Go to the Settings tab, and then to Deployment Protection
  2. From the OPTIONS Allowlist section, select the toggle labelled Enabled:

  3. Once all the paths are added, select Save

Last updated on June 15, 2024