OPTIONS Allowlist

You can use OPTIONS Allowlist to disable Deployment Protection (including Vercel Authentication, Password Protection, and Trusted IPs) on any incoming CORS preflight OPTIONS request for a list of paths.

When you add a path to OPTIONS Allowlist, any incoming request with the method OPTIONS that starts with the path will no longer be covered by Deployment Protection. When you remove a path from OPTIONS Allowlist, the path becomes protected again with the project's Deployment Protection settings.

For example, if you specify /api, all requests to paths that start with /api (such as /api/v1/users and /api/v2/projects) will be unprotected for any OPTIONS request.

1. Go to Project Deployment Protection Settings

   From your Vercel dashboard:

   1. Select the project that you wish to enable Password Protection for
   2. Go to the Settings tab, and then to Deployment Protection

2. Enable OPTIONS Allowlist

   From the OPTIONS Allowlist section, enable the toggle labelled Disabled:

   

3. Specify a path

   Specify a path to add to the OPTIONS Allowlist:

   

4. Add more paths

   To add more paths, select Add path:

   

5. Save changes

   Once all the paths are added, select Save

1. Go to Project Deployment Protection Settings

   From your Vercel dashboard:

   1. Select the project that you wish to enable Password Protection for
   2. Go to the Settings tab, and then to Deployment Protection

2. Disable OPTIONS Allowlist

   From the OPTIONS Allowlist section, select the toggle labelled Enabled:

   

3. Save changes

   Once all the paths are added, select Save