Set up a Vercel connector

C1 provides identity governance and just-in-time provisioning for Vercel. Integrate your Vercel instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access.

Capabilities

The Vercel connector syncs the following resources:

Resource	Sync	Provision
Users		Create
Teams		Grant, Revoke
Access Groups		Grant, Revoke
Projects		Grant, Revoke

Projects and Access Groups are Enterprise-only features in Vercel. If you are using a Hobby or Pro plan, disable the Projects and Access Groups resource types from the ConductorOne UI to avoid 403 authorization errors during sync.

Resource types can also be disabled independently — for example, an Enterprise team that doesn’t use Access Groups can disable just Access Groups without affecting project-level role grants.

Entitlements

The Vercel connector exposes the following entitlements per resource type:

Resource	Entitlement names
Teams	owner, member, developer, billing, viewer, viewer_for_plus, contributor, security
Access Groups	member (access group membership)
Projects	admin, project_developer, project_viewer, project_guest

Grant expansion: The connector syncs Access Group → Project role mappings as grant expansion, allowing ConductorOne to derive transitive project access for Enterprise accounts.

Provisioning notes

• Create account: Creating an account sends an email invitation to the target team. No password is set — the user completes account setup through the invitation link.
• Delete account: Account deletion is not supported by this connector. Only account creation (via email invite) is available.
• Grant team role: If the target user is not yet a member of the team, granting a team role automatically triggers an invite. This may send an email to the user.
• Access Groups and Projects provisioning: Grant and revoke operations for Access Groups and Projects require an Enterprise Vercel plan.

Gather Vercel credentials

To configure the Vercel connector, you need administrator permissions in Vercel.

1. Log in to your Vercel account at vercel.com.

2. Navigate to Settings > Tokens (or visit vercel.com/account/tokens).

3. Create a new Personal Access Token:

   1. Click Create Token
   2. Name it ConductorOne
   3. Set the scope to the team(s) you want to sync
   4. Copy the token and save it securely

   The token must belong to a user with the Owner role on the target team(s).

Configure the Vercel connector

Cloud-hosted

Follow these instructions to use a built-in, no-code connector hosted by ConductorOne.

1. In ConductorOne, navigate to Integrations > Connectors and click Add connector.

2. Search for Vercel and click Add.

3. Choose how to set up the new Vercel connector:

   • Add the connector to a currently unmanaged app
   • Add the connector to a managed app
   • Create a new managed app
4. Set the owner for this connector.

5. Click Next.

6. Find the Settings area of the page and click Edit.

7. Enter the required configuration:

   • API Token: Your Vercel Personal Access Token
   • Team ID (optional): Sync only this team. If omitted, syncs all teams the token can access.
8. Click Save.

9. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your Vercel connector is now pulling access data into ConductorOne.

Self-hosted

Follow these instructions to use the Vercel connector, hosted and run in your own environment.

When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with ConductorOne, automatically syncing and uploading data at regular intervals.

Step 1: Set up a new Vercel connector

1. In ConductorOne, navigate to Integrations > Connectors > Add connector.

2. Search for Baton and click Add.

3. Choose how to set up the new Vercel connector:

   • Add the connector to a currently unmanaged app
   • Add the connector to a managed app
   • Create a new managed app
4. Set the owner for this connector.

5. Click Next.

6. In the Settings area of the page, click Edit.

7. Click Rotate to generate a new Client ID and Client Secret.

   Carefully copy and save these credentials.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your Vercel connector deployment:

Secrets configuration

# baton-vercel-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-vercel-secrets
type: Opaque
stringData:
  # ConductorOne credentials
  BATON_CLIENT_ID: <ConductorOne client ID>
  BATON_CLIENT_SECRET: <ConductorOne client secret>

  # Vercel credentials
  BATON_VERCEL_API_TOKEN: <Vercel Personal Access Token>
  # Optional: scope to a single team
  # BATON_VERCEL_TEAM_ID: <Vercel Team ID>
  # Optional: override the Vercel API URL (testing only, defaults to https://api.vercel.com)
  # BATON_VERCEL_BASE_URL: <Custom API base URL>

See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-vercel.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-vercel
  labels:
    app: baton-vercel
spec:
  selector:
    matchLabels:
      app: baton-vercel
  template:
    metadata:
      labels:
        app: baton-vercel
        baton: "true"
        baton-app: vercel
    spec:
      containers:
      - name: baton-vercel
        image: public.ecr.aws/conductorone/baton-vercel:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-vercel
        envFrom:
        - secretRef:
            name: baton-vercel-secrets

Step 3: Deploy the connector

1. Create a namespace in which to run ConductorOne connectors (if desired), then apply the secret config and deployment config files.

2. Check that the connector data uploaded correctly. In ConductorOne, click Applications. On the Managed apps tab, locate and click the name of the application you added the Vercel connector to. Vercel data should be found on the Entitlements and Accounts tabs.

Done. Your Vercel connector is now pulling access data into ConductorOne.

---

All versions of this connector are available at dist.conductorone.com.