Vercel · infra · fg-0251
Webhooks and API clients calling a Vercel preview URL get a Vercel login page instead of the function
Stripe, Slack, or GitHub webhook deliveries to a preview URL fail with 401 or a redirect to vercel.com/login
Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100
Cause
Standard Protection with Vercel Authentication covers every non production deployment URL, so callers without a Vercel session are redirected to log in. Third party senders cannot pass that check.
Fix
Create a Protection Bypass for Automation secret and send it as the x-vercel-protection-bypass header, or as a query parameter for services that cannot set headers.
Apply
https://$PREVIEW_HOST/api/webhook?x-vercel-protection-bypass=$VERCEL_AUTOMATION_BYPASS_SECRET curl -H "x-vercel-protection-bypass: $VERCEL_AUTOMATION_BYPASS_SECRET" https://$PREVIEW_HOST/api/health
Affects: Vercel projects with Standard Protection and Vercel Authentication (the common default), all plans, as of October 2026
Sources
- https://vercel.com/docs/deployment-protection/methods-to-bypass-deployment-protection/protection-bypass-automation
- https://vercel.com/docs/deployment-protection
Have your agent know this before it fails
claude mcp add --transport http footgun https://getfootgun.com/api/mcp