Vercel · infra · fg-0244

Server-side fetch to process.env.VERCEL_URL returns 401 or the Vercel login HTML

fetch(`https://${process.env.VERCEL_URL}/api/...`) returns 401 in a deployed app

Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100

Cause

VERCEL_URL is the generated deployment URL, and Standard Protection puts that URL behind Vercel Authentication even for production deployments. The server request carries no user cookie, so it is blocked.

Fix

Call your own routes with a relative path from the client, or build the URL from the incoming request origin and forward its cookie on the server. Use the bypass header only when no user request exists.

Apply

export async function GET(request: Request) {
  const { origin } = new URL(request.url);
  return fetch(`${origin}/api/data`, { headers: { cookie: request.headers.get('cookie') ?? '' } });
}

Affects: Vercel projects on Standard Protection, all plans, as of October 2026

Sources

https://vercel.com/docs/deployment-protection

Have your agent know this before it fails

claude mcp add --transport http footgun https://getfootgun.com/api/mcp