trusted-ip-webhook
Public
Pull mirror status: ok
C
Initial commit
app
lib
public
.gitignore
.prettierrc
AGENTS.md
CLAUDE.md
eslint.config.mjs
next.config.ts
package-lock.json
package.json
README.md
tsconfig.json

trusted-ip-webhook

Automatically enables Trusted IPs on every new Vercel project the moment it is created. It works by receiving a project.created webhook from Vercel and immediately calling the Vercel API to apply your IP allowlist.

Requirement: Trusted IPs is a Vercel Enterprise plan feature.

CAUTION

Once this webhook is active, every new project created in your team will have Trusted IPs applied automatically. Projects that should not have IP restrictions — such as public-facing sites or developer sandboxes — will need to be updated manually after creation via Settings → Deployment Protection in the Vercel dashboard.

How it works

  1. Vercel sends a POST /api/webhook request when a new project is created.
  2. The webhook signature is verified using VERCEL_WEBHOOK_SECRET.
  3. The Vercel API is called to apply TRUSTED_IPS to the new project for all deployment types.

Setup

1. Deploy this project to Vercel

vercel deploy

Or connect this repository in the Vercel dashboard.

2. Create a webhook

Go to your account or team webhook settings and create a new webhook:

  • Team: https://vercel.com/teams/{your-team-slug}/settings/webhooks

Set the URL to https://{your-deployed-domain}/api/webhook and enable the project.created event. Vercel will display a signing secret after creation — copy it immediately, as it is only shown once.

3. Set environment variables

Add the following environment variables to this project in the Vercel dashboard under Settings → Environment Variables.

Environment variables

VERCEL_API_TOKEN — required

A Vercel API token used to authenticate calls to the Vercel REST API.

How to generate:

  1. Go to https://vercel.com/account/tokens
  2. Click Create Token
  3. Give it a name (e.g. trust-bot), set the scope to your account or team, and choose an expiration
  4. Copy the token — it is only shown once

The token needs permission to update projects. A Full Account scope token works; for least-privilege, use a team-scoped token with project write access.

VERCEL_WEBHOOK_SECRET — required

The signing secret Vercel generates when you create a webhook. It is used to verify that incoming webhook requests genuinely come from Vercel.

How to get it:

  1. Follow the webhook creation steps above
  2. After clicking Create, Vercel shows the secret once — copy it immediately
  3. If you missed it, delete the webhook and create a new one

TRUSTED_IPS — required

A comma-separated list of IPv4 addresses or CIDR ranges to allowlist. These are applied to every new project with deploymentType: all and protectionMode: additional.

Format:

TRUSTED_IPS=203.0.113.42,10.0.0.0/8,192.168.1.100
  • Single IP: 203.0.113.42
  • CIDR range: 10.0.0.0/8
  • Multiple values: separate with commas, no spaces required

protectionMode: additional means both the IP check and any other configured protection methods (e.g. password, Vercel authentication) apply. Use exclusive mode only if you want IP matching to bypass all other protection — this is not the default.

VERCEL_TEAM_ID — required

Your Vercel team ID, passed as the teamId query parameter on all API calls.

How to find it:

  1. Go to your team's settings: https://vercel.com/teams/{your-team-slug}/settings
  2. The Team ID is listed under General — it starts with team_

Local development

Copy .env.example to .env.local and fill in the values:

cp .env.example .env.local

Run the dev server:

npm run dev

To test the webhook locally, use the Vercel CLI or a tool like ngrok to expose your local server, then point your webhook at the tunnel URL.