How to Password Protect a Vercel Deployment

Vercel Password Protection puts a shared-password gate in front of a deployment. It is available on Pro and Enterprise; Pro may incur an additional project charge. Check the current Password Protection requirements before enabling it.

Choose a protection method

Method	Use it for
Password Protection	Visitors sharing one secret
Vercel Authentication	Access through Vercel identities
Trusted IPs and automation bypasses	Explicit exceptions for approved systems or networks

A shared password confirms that someone knows the secret. It does not identify that person. Choose identity-based access when you need individual access decisions rather than a password passed between recipients.

Enable Vercel Password Protection

1. Open the project in the Vercel dashboard.
2. Select Deployment Protection in the sidebar.
3. Enable Password Protection.
4. Choose the deployment environments to protect.
5. Enter a password and save.
6. Open a protected deployment in a private browser window and test access.

Vercel explains the controls in its Password Protection guide. Only the selected environments are covered. After successful entry, the browser receives a cookie; changing the password invalidates previous password sessions.

Check production and preview URLs separately

Write down which environments should be public and which should require access. Then test the actual addresses people can open:

• The production custom domain.
• The project’s Vercel address.
• A preview deployment URL.
• Any older deployment URL still shared with reviewers.
• A direct URL to a private file or asset.

Do not assume a working password prompt on one preview proves that the production site is protected. Compare each result with the environment selection in the dashboard.

Review bypasses

Automation bypasses, shareable links, and trusted IP settings can intentionally permit access without the password. Review configured exceptions and test from a browser and network that have no bypass. See Vercel’s Password Protection behavior for supported exceptions.

Keep bypass credentials out of publicly accessible scripts, screenshots, and repositories. A link that grants access needs the same care as the password itself.

Test password changes

Before sending the link, try both an incorrect and the correct password in a fresh browser session. Check that approved visitors can load images, navigate between pages, and open downloads.

After rotating the password, verify that the old password fails and the new one works. Repeat the environment checks after changing protection settings or adding a domain.

Avoid client-side password scripts

A browser-based password prompt may expose the site’s source, assets, or password-checking logic before access is approved. Protect private content at the hosting or application layer before serving it.

Access controls also do not make deployed secrets safe: remove API keys, internal notes, and unnecessary development files from the output, even when the site requires a password.

A docs portal with Ask AI
and support tickets

Connect a repository, or describe your product to start. Each docs site has search, Ask AI, an API console, an MCP server and support tickets.

• Publishes from GitHub on every push
• Works with Mintlify repositories
• API console from your OpenAPI file
• MCP server and llms.txt for AI agents
• Ask AI and support tickets
• Analytics for people and AI agents

Start Free→ Questions? Ask AI in our docs

No card required.