Menu
Urgent
React2Shell security update

vercel curl

Last updated November 4, 2025

The command is currently in beta. Features and behavior may change.

The command works like , but automatically handles deployment protection bypass tokens for you. When your project has Deployment Protection enabled, this command lets you test protected deployments without manually managing bypass secrets.

The command runs the system command with the same arguments you provide, but adds an header with a valid token. This makes it simple to test API endpoints, check responses, or debug issues on protected deployments.

This command is available in Vercel CLI v48.8.0 and later. If you're using an older version, see Updating Vercel CLI.

Using the vercel curl command to make an HTTP request to a deployment.

Make a GET request to your production deployment:

Making a GET request to the /api/hello endpoint on your production deployment.

Send a POST request with JSON data:

Making a POST request with JSON data to create a new user.

Test a specific deployment by its URL:

Making a request to a specific deployment instead of the production deployment.

See detailed request information:

Using curl's -v flag for verbose output, which shows headers and connection details.

When you run :

  1. The CLI finds your linked project (or you can specify one with )
  2. It gets the latest production deployment URL (or uses the deployment you specified)
  3. It retrieves or generates a deployment protection bypass token
  4. It runs the system command with the bypass token in the header

The command requires to be installed on your system.

These are options that only apply to the command.

The option, shorthand , lets you specify a deployment URL to request instead of using the production deployment.

Using the --deployment option to target a specific deployment.

The option, shorthand , lets you provide your own deployment protection bypass secret instead of automatically generating one. This is useful when you already have a bypass secret configured.

Using the --protection-bypass option with a manual secret.

You can also use the environment variable:

Setting the bypass secret as an environment variable.

Make sure is installed on your system:

Installing curl on different operating systems.

Make sure you're in a directory with a linked Vercel project and that the project has at least one deployment:

Linking your project and creating a deployment.

If automatic token creation fails, you can create a bypass secret manually in the Vercel Dashboard:

  1. Go to your project's SettingsDeployment Protection
  2. Find "Protection Bypass for Automation"
  3. Click "Create" or "Generate" to create a new secret
  4. Copy the generated secret
  5. Use it with the flag or environment variable

When using , verify that:

  • The deployment ID or URL is correct
  • The deployment belongs to your linked project
  • The deployment hasn't been deleted

The following global options can be passed when using the vercel curl command:

For more information on global options and their usage, refer to the options section.


Was this helpful?

supported.