Start free

Providers / Vercel

Hosting

Vercel API keys and credentials

What every Vercel credential a founder holds does, whether it expires, and what tends to break. Each fact links to Vercel's own docs.

Last checked 2026-11-08 · vercel.com

At a glance

CredentialExpiryPermissions
Vercel dashboard loginNot documented–
Access token (Full Account, Team or Project scope)You chooseCan be scoped
Deploy hook URLNot documentedFull access only

How to rotate the Vercel access token

  1. Open the Account Tokens page from your personal account (not a team view), enter a descriptive token name, then open Scope. Pick Full Account, a team, or (after picking the team) one project; All Projects makes a team-scoped token. Use the narrowest scope that works Vercel docs
  2. Choose an expiration and select Create. Copy the token and store it securely: Vercel shows the value only once. Personal access tokens begin with vcp_ Vercel docs
  3. Or create it from the CLI with vercel tokens create <name>. This needs an existing classic access token (a vercel login session cannot create tokens). A full-account token needs a Full Account token to create it; a project-scoped one (--project <PROJECT_ID>) needs a token scoped to the team that owns the project Vercel docs
  4. Put the new value wherever the old one was used. For the Vercel CLI, that is the VERCEL_TOKEN environment variable or the --token flag; Vercel recommends the environment variable for CI/CD because it keeps the token out of command-line arguments, which can show in process lists and logs Vercel docs
  5. For GitHub Actions: Vercel's docs show workflows passing the token as --token=${{ secrets.VERCEL_TOKEN }}, so replace the value of the GitHub repository (or environment) secret your workflow reads, and re-run the workflow. The Vercel docs do not describe the GitHub side of editing a secret Vercel docs
  6. Once nothing uses the old token, revoke it: run vercel tokens list to find its ID, then vercel tokens revoke <id> (it asks you to confirm; --yes skips the prompt) Vercel docs

Can the old and new key work at the same time? Yes. The docs do not state outright that two tokens can work at once. They do show tokens being created with their own names and revoked one by ID, so a new token can be made and put in place before the old one is revoked. The docs also do not say whether an existing token can be edited (renamed, re-scoped or given a new expiry) or has to be recreated; the pages read describe creation and revocation only.

Revoking the old one: Run vercel tokens revoke <id> (find the ID with vercel tokens list), or call DELETE /v3/user/tokens/{tokenId}, which invalidates the token for future requests (https://vercel.com/docs/rest-api/authentication/delete-an-authentication-token). The docs say that after revoking, anything that uses the token stops working. The pages read do not describe a dashboard delete button.

Source: vercel.com/docs/accounts/access-tokens, checked

Does the Vercel access token expire?

It's up to you: you can set an expiry for the Vercel access token.

What breaks when the Vercel access token expires

Requests with an expired, wrong or deleted token get a 403 response whose error object has "invalidToken": true. Vercel's fix: check the header is Authorization: Bearer <token>, check the token still appears on the Account Tokens page, and if it is lost or expired, create a new one. If a GitHub Actions workflow passes the old token through secrets.VERCEL_TOKEN, update that secret. A missing or malformed header gives 403 with "missingToken": true instead. The docs do not give the exact CLI error text.

Other things that often go wrong with Vercel:

How to rotate the Vercel deploy hook URL

  1. In the project, open Settings, then Git. In the Deploy Hooks section, choose a name and the branch to deploy, and submit. Vercel then shows the URL to copy. The project must be connected to a Git repository Vercel docs
  2. Or use the CLI: vercel deploy-hooks create <name> --git-branch <branch>, which returns the hook URL Vercel docs
  3. Replace the old URL with the new one in every system that calls it (for example a CMS publish webhook or a cron service). Vercel's docs say to treat the URL like any other token or password Vercel docs
  4. Delete the old hook (see Revoke). The docs say that if you believe a URL has been compromised, you can revoke it and create a new one Vercel docs

Can the old and new key work at the same time? Yes. Hobby and Pro projects can have 5 deploy hooks and Enterprise projects 10, each with its own URL, so a new hook can exist next to the old one until you delete the old one. The docs do not use the word overlap; this follows from hooks being created and deleted individually. Trigger limit: 60 per hour per project across all hooks. Vercel's deploy hooks page suggests one hook per branch unless you use several data sources, so keep the overlap short; a project already at its cap has to delete one first.

Revoking the old one: Delete the old hook by ID with vercel deploy-hooks delete <id> (find the ID with vercel deploy-hooks list; --yes with --non-interactive skips the prompt). The docs say hooks can be revoked, but the pages read do not show the dashboard button for deleting one.

Source: vercel.com/docs/deploy-hooks, checked

Does the Vercel deploy hook URL expire?

Vercel's docs don't say whether the Vercel deploy hook URL expires.

What breaks when the Vercel deploy hook URL expires

The docs do not say deploy hook URLs expire. If a hook was deleted, the docs do not say what a POST to its URL returns. If a hook stops starting builds, the docs say to check the status check on the commit tied to the hook, and note that hooks do not trigger when github.enabled = false is set in vercel.json.

Each credential

Vercel dashboard login

Some teams require two-factor authentication or SAML before their tokens can be created.

Vercel docs

Access token (Full Account, Team or Project scope)

The list-tokens endpoint (GET /v6/user/tokens) shows expiresAt in its example response, though it is not a required field (see https://vercel.com/docs/rest-api/authentication/list-auth-tokens). Token value is shown once. Scopes are Full Account, a single Team, or a single Project; project-scoped tokens cannot create tokens, and full-account tokens must pass teamId (or slug) when targeting a team's resources. Personal access tokens begin with vcp_. An expired token returns 403 invalidToken.

Vercel docs

Deploy hook URL

The URL itself is the credential. Anyone holding it can trigger a deployment with a plain GET or POST, no auth header. Each hook is bound to one project and one branch. Revoke a leaked hook by deleting it and creating a new one. Hobby and Pro allow 5 hooks per project (Enterprise 10) and 60 triggers per hour per project.

Vercel docs

Renewals and billing

Pro is a monthly platform fee plus per-seat charges and on-demand usage beyond the included monthly credit. Spend management can send alerts or take automatic actions at spend thresholds; notifications on by default at $200 per billing cycle. GET /v1/billing/charges returns FOCUS v1.3 charge rows (JSONL) per team, daily granularity, max one-year range; rows carry ProjectId and ProjectName in Tags.

Where to find it in Vercel

What Vercel's docs don't say

We couldn't confirm these from official docs, so don't rely on them either way:

Rotating or replacing a Vercel key

The steps are the same for most providers: make the new key, deploy it everywhere the old one is used, check it works, then revoke the old one. Our guides walk through it:

Rotate an API keyWithout downtime, in the right order. A key leakedWhat to do in the first hour.

Sources

Related providers

Fly.ioHosting RailwayHosting RenderHosting

Keep track of every Vercel key

StackHangar stores your Vercel keys in an encrypted vault, grouped by the product they belong to, warns you before they expire, and walks you through rotating them. We can't read your secrets.

Start free with 2 projectsHow the vault works