11ai Vercel Passport setup

Resolve team, role, project inventory, identity provider administrator, rollout scope, break-glass owner, and protected deployment types before changing either system.

Version baseline: Use current Vercel Passport Enterprise public-beta behavior as of July 2026. The hosted product has no version number, so verify provider and dashboard behavior against current documentation.

Gather first

Confirm issuer and discovery, confidential client support, callback, openid scope, user assignments, provider secret owner, project list, and rollback. Never invent endpoints or credentials.

Configure

Register https://connect.vercel.com/callback
Select authorization_code and openid
Assign a test user and one pilot project

Use dashboard secret fields directly. Never paste a client secret into a terminal, file, transcript, or screenshot.

Read references/setup.md for the standalone provider and Vercel sequence.

Verify

npm run typecheck --if-present
npm test --if-present
npm run build --if-present

Use an assigned and unassigned test identity on a pilot deployment before broader rollout. Verify direct URLs and server identity separately.

Guardrails

Ask before enabling defaults, assigning projects, changing protection methods, or rotating secrets. Report team, provider, pilot project, scopes, protected deployment types, identities tested, files, checks, and rollback.