Enterprise plans
Passport lets you protect deployments with your own identity provider. Visitors authenticate with your identity provider before they can view a protected deployment.
Restrict access to deployments with Passport
Use Passport when you want visitors to sign in with an external identity provider, such as Microsoft Entra ID, Okta, or another OpenID Connect compatible provider. Vercel Connect stores the OAuth application configuration that talks to your identity provider.
Copy page
- Vercel Connect application: The OAuth or OpenID Connect configuration that stores your identity provider's issuer, endpoints, client ID, and client secret.
- Project or team setting: The Passport configuration that selects the Connect application and controls whether Passport is enabled.
Passport has two parts:
How Passport works
New to Passport? Set up Passport with an identity provider first, then return to the other guides when you need to use identity in application code.
Those with the ownerrolecan manage Passport
When a visitor opens a protected deployment, Vercel redirects them to your identity provider. After the identity provider authenticates the visitor, Vercel validates the response and sets a session cookie for the protected deployment.
Set up Passport with an identity provider
Configure Passport for Okta, Microsoft Entra ID, and other OIDC providers.
Configure additional identity scopes
Request group membership and other provider-specific identity claims.
Monitor Passport access
In the Activity Log, select Filter by Event, then select passport-access-granted to view Passport access events.
Pricing
Last updated July 30, 2026
Passport is available as an Enterprise feature. Contact your Vercel account team for pricing.
When a visitor successfully authenticates to a Passport-protected project, Vercel records a passport-access-granted event in both the Activity Log and Audit Logs. The event identifies the visitor and records the protected hostname and project context.
Set Up Passport
- Deployment Protection
- Methods to protect deployments
- Vercel Authentication
- Protection Bypass for Automation: Access a Passport-protected deployment without an identity provider session. Send the bypass secret with the original request because Passport runs before deployment routes and Next.js proxy functions.
Cross-link map: Restrict access to deployments with Passport (/docs/passport)From the Vercel docs graph (built 2026-09-21T05:26:59.511Z), spanning vercel.com docs + KB, nextjs.org, ai-sdk.dev, and other Vercel documentation sites. Full graph as JSON: https://vercel.com/docs/graph.jsonSemantically closest pagesThe Complete Guide to Vercel Passport — Vercel Passport protects deployments behind your own identity provider, such as Okta or Auth0. Learn how Passport works,Methods to Protect Deployments — Vercel offers several methods to protect your deployments: Vercel Authentication, Passport, Password Protection, and TruSet up Passport with an identity provider — Configure Passport with Okta, Microsoft Entra ID, or another OpenID Connect provider.Vercel Passport is now generally availableRead Passport identity in your application — Read verified Passport identity in server-side code and apply application-level authorization.This page links to (11)Audit Logs — Learn how to track and analyze your team members' activities.Deployment Protection on Vercel — Learn how to control access to your Vercel project's preview and production URLs with Deployment Protection. Configure pProtection Bypass for Automation — Learn how to bypass Vercel Deployment Protection for automated tooling \(e.g. E2E testing\).Methods to Protect Deployments — Vercel offers several methods to protect your deployments: Vercel Authentication, Passport, Password Protection, and TruRestrict access to deployments with Vercel Authentication — Vercel Authentication restricts access to your deployments so only authorized users can view and comment on your site.Configure additional identity scopes — Request group membership and other provider-specific identity claims when using Passport.Forward Passport identity to another backend — Forward a Passport visitor identity to another backend that you operate.Read Passport identity in your application — Read verified Passport identity in server-side code and apply application-level authorization.Set up Passport with an identity provider — Configure Passport with Okta, Microsoft Entra ID, or another OpenID Connect provider.Passport token claims — Review the standard, deployment, and visitor identity claims in a Passport token.Verify forwarded Passport tokens — Verify a Passport token forwarded to your backend as a signed JWT.Pages that link here (9)By site: vercel-changelog (2) · vercel-kb (1) · vercel-web (1) · vercel-docs (5)From vercel-changelogVercel Passport is now generally availableVercel Passport is now in Public BetaFrom vercel-kbHow to identify and authorize visitors with the Vercel Passport token in Next.js — Read the Vercel Passport token server-side in a Next.js app to identify visitors with the external_sub claim and authoriFrom vercel-webVercel Pricing — Choose a Vercel plan and compare features and usage pricing.From vercel-docsAuth.js — Add a Vercel Connect OAuth provider to Auth.js in a Next.js App Router application.Better Auth — Use Vercel Connect as a generic OAuth provider for Better Auth in a Next.js application.Deployment Protection on Vercel — Learn how to control access to your Vercel project's preview and production URLs with Deployment Protection. Configure pMethods to Protect Deployments — Vercel offers several methods to protect your deployments: Vercel Authentication, Passport, Password Protection, and TruUsage & Pricing for Deployment Protection — Compare Deployment Protection feature availability and pricing across Hobby, Pro, and Enterprise plans.
Was this helpful?
