Vercel

What the connection is#

deplo.ai never hosts your frontend — it deploys into your Vercel account through the official deplo.ai Vercel integration. You're prompted to connect during onboarding, and can also connect from Dashboard → Integrations or the terminal with deplo connect vercel. Authorizing takes one click on Vercel's side; no keys to copy.

How the OAuth flow works#

The state parameter is a short-lived signed JWT carrying your user id, so deplo.ai can identify you on the callback without a server-side session — and reject any callback whose state wasn't issued to you (CSRF protection). If anything fails, you're redirected back with the reason in the URL instead of a dead end.

What deplo.ai can do in your account#

The stored token is used exclusively by the deployment pipeline and monitoring. Concretely, deplo.ai:

• Creates or reuses projects in your account (or the team you authorized), with the detected framework preset, root directory for monorepos, and build settings.
• Sets project environment variables — the values you provide, plus wiring like NEXT_PUBLIC_API_URL pointing at your freshly deployed backend.
• Uploads your build and triggers deployments, then polls until the deployment is ready.
• Reads the production domain — the *.vercel.app URL actually assigned to the project, which is what lands in your deployment log and monitoring.

Your projects stay yours#

A frontend deployed by deplo.ai is indistinguishable from one you created by hand: it appears in your Vercel dashboard as a regular project. Custom domains, Vercel Analytics, preview settings, extra environment variables — all of it is managed on Vercel's side, by you, and none of it is touched by deplo.ai outside of a deploy. If you stop using deplo.ai tomorrow, every project keeps running untouched.

Framework presets#

The analysis engine maps each detected frontend framework to the matching Vercel framework preset, so Vercel's own framework-aware build defaults apply instead of hand-rolled overrides:

Token storage and security#

• The OAuth token is encrypted with AES-256-GCM before it touches the database, in the per-user provider connection record.
• It is never returned by any API — GET /api/v1/integrations reports only the connection status and account/team names.
• Deployments always run in your account; there are no shared platform credentials.

Full details in Authentication & Security.

Disconnecting#

Disconnect from Dashboard → Integrations, which calls:

DELETE /api/v1/integrations/vercel
Authorization: Bearer <token>

{ "disconnected": true }

Uninstalling the deplo.ai integration from your Vercel dashboard works too — Vercel notifies deplo.ai via webhook and the connection is marked disconnected automatically. Either way:

• New frontend deployments fail fast with “Vercel account not connected” until you reconnect.
• Existing projects and live deployments in your Vercel account are unaffected.
• Reconnecting is the same one-click flow and simply replaces the stored token.