Server-side fetch to process.env.VERCEL_URL returns 401 or the Vercel login HTML

Symptom

fetch(`https://${process.env.VERCEL_URL}/api/...`) returns 401 in a deployed appJSON.parse fails on an HTML login pageOG image or internal API calls work in production domain but fail on preview

Cause

VERCEL_URL is the generated deployment URL, and Standard Protection puts that URL behind Vercel Authentication even for production deployments. The server request carries no user cookie, so it is blocked.

Fix

Call your own routes with a relative path from the client, or build the URL from the incoming request origin and forward its cookie on the server. Use the bypass header only when no user request exists.

ApplyCopy

export async function GET(request: Request) { const { origin } = new URL(request.url); return fetch(`${origin}/api/data`, { headers: { cookie: request.headers.get('cookie') ?? '' } }); }

Affected

Vercel projects on Standard Protection, all plans, as of October 2026

Sources

• https://vercel.com/docs/deployment-protection

Last verified 2026-10-15 · Confirmed by 0 builders