Trusted IPs

Learn how to restrict access to your deployments to a list of trusted IP addresses.

Table of Contents

Trusted IPs are available on Enterprise plans

Those with the owner, member and admin roles can manage Trusted IPs

With Trusted IPs enabled at the level of your project, only visitors from an allowed IP address can access your deployment. The deployment URL will return 404 No Deployment Found for all other requests. Trusted IPs is configured by specifying a list of IPv4 addresses and IPv4 CIDR ranges.

Trusted IPs is suitable for customers who access Vercel deployments through a specific IP address. For example, limiting preview deployment access to your VPN. Trusted IPs can also be enabled in production, for example, to restrict incoming access to only requests through your external proxy.

Trusted IPs security considerations

The table below outlines key considerations and security implications when using Trusted IPs for your deployments on Vercel.

Consideration	Description
General Considerations
Environment Configuration	Can be enabled for different environments. See Understanding Deployment Protection by environment
Compatibility	Operates as a required layer on top of Vercel Authentication and Password Protection. For optional layering, see Standalone Trusted IPs
Bypass Methods	Can be bypassed using Shareable Links and Protection Bypass for Automation
IP Address Support	Supports IPv4 addresses and IPv4 CIDR ranges
Prerequisites
Preview Environment Requirements	Can only be enabled in preview when Vercel Authentication is also enabled. For independent use, see Standalone Trusted IPs
External Proxy Configuration	Requires rulesets configuration to avoid blocking proxy IPs. Contact our sales team for more information
Security Considerations
Firewall Precedence	Vercel Firewall takes precedence over Trusted IPs
IP Blocking	IPs or CIDRs listed in IP Blocking will be blocked even if listed in Trusted IPs
DDoS Mitigation	Trusted IPs do not bypass DDoS Mitigation unless configured
Deployment Impact	Changing the Trusted IPs list affects all deployments
Disabling Trusted IPs	Disabling makes all existing deployments accessible from any IP

Standalone Trusted IPs

Standalone Trusted IPs is an optional add-on to your Enterprise plan, contact our sales Team to learn more. Standalone Trusted IPs allows for the following:

Allows Trusted IPs to be configured to be optional, so it behaves as a bypass to Vercel Authentication & Password Protection
Allows Trusted IPs to be enabled in preview environments independently of Vercel Authentication
- It is however recommended to have Trusted IPs as an additional security measure on-top of Vercel Authentication, as relying solely on request IP matching for security is vulnerable to IP spoofing
- Additionally, Vercel Authentication enhances Vercel collaboration features like Comments. See who can access a deployment protected with Vercel Authentication

Managing Trusted IPs

You can manage Trusted IPs through the dashboard, API, or Terraform:

Manage using the dashboard

Go to Project Deployment Protection Settings

From your Vercel dashboard:

Select the project that you wish to enable Trusted IPs for
Go to Settings then Deployment Protection

Manage Vercel Authentication

Ensure Vercel Authentication is enabled. See Managing Vercel Authentication.

Manage Trusted IPs

From the Trusted IPs section:

Use the toggle to enable the feature
Select the deployment environment you want to protect
Enter your list of IPv4 addresses and IPv4 CIDR ranges with an optional note describing the address
Finally, select Save

All your existing and future deployments will be protected with Trusted IPs for that project. Visitors to your project deployments from IP addresses not included in your list will see a No Deployment Found error page.

Manage using the API

You can manage Trusted IPs using the Vercel API endpoint to update an existing project with the following body

deploymentType
- prod_deployment_urls_and_all_previews: Standard Protection
- all: All Deployments
- preview: Only Preview Deployments
- production: Only Production Deployments
addresses: Array of addresses
- value: The IPv4, or IPv4 CIDR address
- note: Optional note about the address
- protectionMode
  - additional: IP is required along with other enabled protection methods (recommended setting)
  - exclusive: Trusted IPs is optional, it bypasses other protection methods (only available when Standalone Trusted IPs is enabled for the team)

// enable / update trusted ips
{
  "trustedIps": {
      "deploymentType": "all" | "preview" | "production" | "prod_deployment_urls_and_all_previews",
      "addresses": { "value": "<value>"; "note": "<note>" | undefined }[],
      "protectionMode": "additional" | "exclusive"
  }
}
// disbale trusted ips
{
  "trustedIps": null
}

Manage using Terraform

You can configure Trusted IPs using trusted_ips in the vercel_project data source in the Vercel Terraform Provider.

Last updated on April 27, 2024

Password Protection

Methods to bypass Deployment Protection

Was this helpful?