Vercel tokens don’t have granular read/write scoping — TigerGate only ever
issues read (
GET) requests with the token, regardless of what it’s
technically capable of.Before you start
In TigerGate, open Integrations → Cloud Providers and add a Vercel connection. You’ll fill in two credential values:| Field | What it is |
|---|---|
API Token (token) | A Vercel API token with read access to the team’s projects. Required. |
Team ID (team_id) (optional) | Restricts the connection to a single team — leave blank to use whatever the token can access. |
1. Create the token
Scope it to the target team
Name it
tigergate-cspm-scan, set an expiration per your rotation
policy, and select the specific Team you want scanned (or “Full
Account” if you want TigerGate to see every team the token’s owner
belongs to).2. Connect it in TigerGate
Paste the token
In Integrations → Cloud Providers, add a Vercel connection and
paste the token into API Token. Set Team ID (Team Settings →
General) if the token can see multiple teams and you want to restrict the
scan to one.
Test
Click Test. For Vercel this is a field-presence check — it confirms
the API Token field is filled in and marks the connection
Connected. The token is not yet exercised against the Vercel API, so a
present-but-invalid token still passes this check; it’s validated on the
first scan.
Troubleshooting
Because Test only checks that the token field is filled in, credential problems surface when a scan actually runs.| Scan symptom | Likely cause | Fix |
|---|---|---|
| Scan fails to authenticate | Token is wrong, expired, or the account it belongs to was removed from the team | Generate a new token from an account that’s still a team member |
| No team data / team not found | Team ID doesn’t match, or the token wasn’t scoped to that team | Re-check the ID under Team Settings → General, or leave the field blank |
| Scan runs but few findings | Token was scoped to a personal account, not the team | Re-generate the token with the Team scope set explicitly |