# Trusted Sources for Deployment Protection

DevFeed: [Trusted Sources for Deployment Protection](<https://devfeed.tech/articles/trusted-sources-for-deployment-protection-1113.md>)

Original publisher: [Read original article](<https://vercel.com/changelog/trusted-sources-for-deployment-protection>)

Author: Tim White

Published: 2026-05-13T00:00:00Z

Content type: release

Language: en

Sources: [Vercel News](<https://devfeed.tech/sources/vercel-news.md>)

Topics: [Vercel](<https://devfeed.tech/topics/vercel.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [Deployment](<https://devfeed.tech/topics/deployment.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>)

Tags: [deployment](<https://devfeed.tech/tags/deployment.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [identity](<https://devfeed.tech/tags/identity.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [vercel](<https://devfeed.tech/tags/vercel.md>)

## AI overview

Vercel introduces Trusted Sources for Deployment Protection, allowing protected deployments to accept short-lived OIDC identity tokens from authorized Vercel projects and external services. The feature supports configurable project and environment rules, including integrations with GitHub Actions, while the existing Protection Bypass for Automation secret remains supported.

## Source excerpt

Trusted Sources lets protected deployments accept short-lived identity tokens (OIDC) from Vercel projects and external services you authorize, so you no longer have to share a long-lived Protection Bypass for Automation secret. Trusted Sources is the recommended approach, but Protection Bypass for Automation continues to work Callers attach an OIDC token in the x-vercel-trusted-oidc-idp-token header. Vercel then verifies the signature, checks the claims you configured, and confirms the environment matches the rule. Authorize Vercel projects By default, the Vercel OIDC token for a project can call its own deployments. To authorize another project in the same team, add it to Trusted Sources. Self-access and cross-project rules are both customizable with from/to environment pairs. To authenticate a request from a project, forward its Vercel OIDC token: Authorize external services Any custom OIDC provider can be authorized as a trusted external service, such as GitHub Actions, or a Vercel project in another team. Read the documentation to learn more. Read more