Safely bypass Vercel deployment protection
# supportm
Mikael Lirbank
05/01/2025, 2:35 PMWe need to dynamically set the server URL of tool functions, so we use ephemeral assistants.
To bypass Vercel's deployment protection on preview deployments, one can just pass an extra header
x-vercel-protection-bypassv
Vapi Support Bot
05/01/2025, 2:37 PMHey! I couldn't find enough details to help you safely bypass Vercel deployment protection. I'm escalating your query to one of our team members who can assist you further 😊
m
Mikael Lirbank
05/01/2025, 2:43 PMI guess my question is actually more generally about securing ephemeral assistants.
Since the assistant is fully configured in the client and then just sent to Vapi using the public key, anyone can use my account to generate arbitrary assistants by simply grabbing my public key.
Mikael Lirbank
05/01/2025, 2:45 PMAlso thinking this will not work with ephemeral assistants https://docs.vapi.ai/server-url/server-authentication
Eg. no point in passing a secret from the client to Vapi as it is compromised from the start.
Mikael Lirbank
05/01/2025, 3:11 PMOooh, just found org level server URls, maybe the answer is there https://dashboard.vapi.ai/org/settings
Mikael Lirbank
05/01/2025, 3:58 PMI got the vercel bypass working by setting the header in the org level settings.
I had to set an arbitrary Server URL to be able to save the headers though. I just set it to "https://example.com".
Mikael Lirbank
05/01/2025, 4:05 PMThis also covers setting up the x-vapi-secret to validate function calls authenticity.
Mikael Lirbank
05/01/2025, 4:06 PMThe remaining questions is how to think protecting against people grabbing my public API key and creating arbitrary ephemeral voice assistants.
c
Chiranjeet Mishra
05/02/2025, 8:23 PMUsing your public key, people cannot create assistants; they can only create calls that you can limit to the assistant and/or the domains/origins. Let me know what you think about this.
4 Views