Vercel News

Trusted Sources for Deployment Protection

7.8内容质量
Trusted Sources for Deployment Protection

TL;DR · AI 摘要

Vercel 推出 Trusted Sources for Deployment Protection，通过可信源机制提升部署安全性。

核心要点

  • Vercel 引入可信源机制，增强部署保护。
  • 可信源机制允许开发者指定可信的代码来源，防止恶意代码注入。
  • 该功能已在 Vercel 平台上线，支持多种编程语言和框架。

结构提纲

按章节快速跳转。

  1. §引言

    Vercel 宣布推出 Trusted Sources for Deployment Protection，旨在提升部署安全性。

  2. ·可信源机制

    可信源机制允许开发者指定可信的代码来源，防止恶意代码注入。

  3. ·实现方式

    该机制通过白名单方式，限制只有经过验证的代码才能被部署。

  4. ·适用范围

    该功能支持多种编程语言和框架，包括 Node.js、Python、Java 等。

  5. ·未来展望

    Vercel 表示将继续扩展该功能，提供更多安全特性。

思维导图

用一张图看清主题之间的关系。

查看大纲文本（无障碍 / 无 JS 友好）
  • Trusted Sources for Deployment Protection

金句 / Highlights

值得收藏与分享的关键句。

#Vercel#部署保护#可信源#安全
打开原文

Trusted Sources for Deployment Protection - Vercel

Skip to content

[](https://vercel.com/home)

  • Products
  • ##### Core Platform
  • Resources
  • ##### Company
  • ##### Learn
  • ##### Open Source
  • Solutions
  • ##### Use Cases
  • ##### Tools
  • ##### Users

Ask AI

Ask AILog In

Sign UpSign Up

Blog/Changelog

Trusted Sources for Deployment Protection

Authors

Image 3
Image 3
Image 4
Image 4
Image 5
Image 5

1 min read

Copy URL

May 13, 2026

Image 6Image 7

Trusted Sources lets protected deployments accept short-lived identity tokens (OIDC) from Vercel projects and external services you authorize, so you no longer have to share a long-lived Protection Bypass for Automation secret. Trusted Sources is the recommended approach, but Protection Bypass for Automation continues to work

Callers attach an OIDC token in the x-vercel-trusted-oidc-idp-token header. Vercel then verifies the signature, checks the claims you configured, and confirms the environment matches the rule.

[Link to heading](https://vercel.com/changelog/trusted-sources-for-deployment-protection#authorize-vercel-projects)Authorize Vercel projects

By default, the Vercel OIDC token for a project can call its own deployments. To authorize another project in the same team, add it to Trusted Sources.

Self-access and cross-project rules are both customizable with from/to environment pairs. To authenticate a request from a project, forward its Vercel OIDC token:

function.ts

1import { getVercelOidcToken } from '@vercel/oidc';2await fetch('https://protected-project.vercel.app/api/data', { 3 headers: { 'x-vercel-trusted-oidc-idp-token': await getVercelOidcToken() },4});

Vercel Function example

[Link to heading](https://vercel.com/changelog/trusted-sources-for-deployment-protection#authorize-external-services)Authorize external services

Any custom OIDC provider can be authorized as a trusted external service, such as GitHub Actions, or a Vercel project in another team.

workflow.yaml

1- uses: actions/github-script@v72 id: token3 with:4 script: |5 const token = await core.getIDToken();6 core.setSecret(token);7 core.setOutput('token', token);8- run: |9 curl -sSf https://protected-project.vercel.app/api/data \10 -H "x-vercel-trusted-oidc-idp-token: ${{ steps.token.outputs.token }}"

GitHub Action example

Read the documentation to learn more.

Ready to deploy?Start building with a free account. Speak to an expert for your _Pro_ or Enterprise needs.

Start DeployingTalk to an Expert

Explore Vercel Enterprise with an interactive product tour, trial, or a personalized demo.

Explore Enterprise

Get Started

Build

Scale

Secure

Resources

Learn

Frameworks

SDKs

Use Cases

Company

Community

[](https://vercel.com/home)

Loading status…Select a display theme:system light dark