Why can’t I find Password Protection in my Vercel project settings?

Check Deployment Protection in the project sidebar and confirm plan eligibility. Password Protection is available on Pro and Enterprise; Pro may incur a project charge.

Does Vercel Password Protection cover both preview and production deployments?

Only the deployment environments selected in your settings are protected. Test preview and production URLs separately in a private browser window to confirm that each intended environment prompts for the password.

What happens after I change the Vercel deployment password?

Visitors must enter the new password before accessing the protected deployment again. Retest the deployment while signed out to verify that the previous credentials no longer provide access.

Can someone bypass Vercel Password Protection?

Configured automation bypass links, trusted IP rules, or other bypass methods may intentionally permit access without the shared password. Review these settings carefully and test from an untrusted browser or network when validating protection.

Should I use Password Protection or Vercel Authentication?

Use Password Protection when a small, trusted group can safely share one secret. Choose Vercel Authentication when you need identity-based access, individual accountability, or tighter team controls.

Can a client-side JavaScript password prompt secure a Vercel site?

No. A browser-based prompt may expose the site’s source, assets, or password-checking logic before access is approved. Private content should be protected by the hosting layer before any files are served.

How to Password Protect a Vercel Deployment

Choose a protection method
Enable Vercel Password Protection
Check production and preview URLs separately
Review bypasses
Test password changes
Avoid client-side password scripts

Vercel Password Protection puts a shared-password gate in front of a deployment. It is available on Pro and Enterprise; Pro may incur an additional project charge. Check the current Password Protection requirements before enabling it.

Choose a protection method

Method	Use it for
Password Protection	Visitors sharing one secret
Vercel Authentication	Access through Vercel identities
Trusted IPs and automation bypasses	Explicit exceptions for approved systems or networks

A shared password confirms that someone knows the secret. It does not identify that person. Choose identity-based access when you need individual access decisions rather than a password passed between recipients.

Enable Vercel Password Protection

Open the project in the Vercel dashboard.
Select Deployment Protection in the sidebar.
Enable Password Protection.
Choose the deployment environments to protect.
Enter a password and save.
Open a protected deployment in a private browser window and test access.

Vercel explains the controls in its Password Protection guide. Only the selected environments are covered. After successful entry, the browser receives a cookie; changing the password invalidates previous password sessions.

Check production and preview URLs separately

Write down which environments should be public and which should require access. Then test the actual addresses people can open:

The production custom domain.
The project’s Vercel address.
A preview deployment URL.
Any older deployment URL still shared with reviewers.
A direct URL to a private file or asset.

Do not assume a working password prompt on one preview proves that the production site is protected. Compare each result with the environment selection in the dashboard.

Review bypasses

Automation bypasses, shareable links, and trusted IP settings can intentionally permit access without the password. Review configured exceptions and test from a browser and network that have no bypass. See Vercel’s Password Protection behavior for supported exceptions.

Keep bypass credentials out of publicly accessible scripts, screenshots, and repositories. A link that grants access needs the same care as the password itself.

Test password changes

Before sending the link, try both an incorrect and the correct password in a fresh browser session. Check that approved visitors can load images, navigate between pages, and open downloads.

After rotating the password, verify that the old password fails and the new one works. Repeat the environment checks after changing protection settings or adding a domain.

Avoid client-side password scripts

A browser-based password prompt may expose the site’s source, assets, or password-checking logic before access is approved. Protect private content at the hosting or application layer before serving it.

Access controls also do not make deployed secrets safe: remove API keys, internal notes, and unnecessary development files from the output, even when the site requires a password.

Get Email address for your AI agent

Create a cloud bucket and copy its <unique.id>@revdokumail.com email address.
Emails sent to this email are saved as JSON and Markdown, attachments are extracted.
Connect AI agents to read and manage saved emails and files via the API, CLI, MCP, or Skill.

Create Free Accountor connect your AI agent

const apiKey = process.env.REVDOKU_API_KEY; // Get a key at https://app.revdoku.com/account/access
if (!apiKey) throw new Error("Set REVDOKU_API_KEY first");

const response = await fetch(
  "https://app.revdoku.com/api/v1/buckets", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${apiKey}`,
      "Content-Type": "application/json"
    },
    body: JSON.stringify({ bucket: { title: "My agent inbox" } })
  }
);
if (!response.ok) {
  throw new Error(`HTTP ${response.status}: ${await response.text()}`);
}
const { data } = await response.json();
const inbox = data.bucket.inbound_email;
console.log("Bucket ID:", data.bucket.id);
console.log("Email:", inbox.address);
console.log("Ready:", inbox.ready);
console.log("Open:", data.bucket.dashboard_url);
if (!inbox.ready) console.log("Receiving:", inbox.blocked_reason);