# Trusted Sources for Deployment Protection

**Published:** May 13, 2026 | **Authors:** Kit Foster, Marc Greenstock, Tim White

---

[Trusted Sources](https://vercel.com/docs/deployment-protection/methods-to-bypass-deployment-protection/trusted-sources) lets protected deployments accept [short-lived identity tokens (OIDC)](https://vercel.com/docs/oidc) from Vercel projects and external services you authorize, so you no longer have to share a long-lived [Protection Bypass for Automation](https://vercel.com/docs/deployment-protection/methods-to-bypass-deployment-protection/protection-bypass-automation) secret. Trusted Sources is the recommended approach, but Protection Bypass for Automation continues to work

Callers attach an OIDC token in the `x-vercel-trusted-oidc-idp-token` header. Vercel then verifies the signature, checks the claims you configured, and confirms the environment matches the rule.

### Authorize Vercel projects

By default, the [Vercel OIDC token](https://vercel.com/docs/oidc/reference) for a project can call its own deployments. To authorize another project in the same team, add it to Trusted Sources.

Self-access and cross-project rules are both customizable with `from`/`to` environment pairs. To authenticate a request from a project, forward its Vercel OIDC token:

**function.ts**
```typescript
import { getVercelOidcToken } from '@vercel/oidc';
await fetch('https://protected-project.vercel.app/api/data', {  
  headers: { 'x-vercel-trusted-oidc-idp-token': await getVercelOidcToken() },
});
```

### Authorize external services

Any custom OIDC provider can be authorized as a trusted external service, such as GitHub Actions, or a Vercel project in another team.

**workflow.yaml**
```yaml
- uses: actions/github-script@v7
  id: token
  with:
    script: |
      const token = await core.getIDToken();
      core.setSecret(token);
      core.setOutput('token', token);
- run: |
    curl -sSf https://protected-project.vercel.app/api/data \
      -H "x-vercel-trusted-oidc-idp-token: ${{ steps.token.outputs.token }}"
```

Read the [documentation](https://vercel.com/docs/deployment-protection/methods-to-bypass-deployment-protection/trusted-sources) to learn more.

---

📚 **More updates:** [View all changelog entries](/changelog/sitemap.md) | [Blog](/blog/sitemap.md)