Hi, every request to my projects that does not come from a browser gets 403 with x-vercel-mitigated: challenge and the Vercel Security Checkpoint page. This includes my Android app's HTTP client (Dart), curl and Node fetch.
It happens on two projects:
- truwire-api (
truwire-api-ecru.vercel.app) — deleted since, same problem - truwire-backend (
truwire-backend.vercel.app), a brand-new project with no errors and almost no traffic. It was challenged from its very first request.
What I checked:
- Firewall → Traffic on truwire-api lists the rule as DDoS Mitigation
- Bot Protection: Off
- AI Bots: Off
- Attack Challenge Mode: not enabled
- A custom rule with Bypass for all paths: does not help
These projects are JSON APIs for a mobile app, so the app cannot solve browser challenges and gets no data at all.
Example request IDs:
sin1::1794199134-BHR6K1SKR2S5b9DhO5D7rhT5uRO4MEedsin1::1794197243-jtbomOdsDDssQ6WIrNxwEA5uyTwdLy2F
Could someone from the Vercel team please review this and lift the mitigation for my account? Thank you!