Production API and vercel dev blocked by X-Vercel-Mitigated challenge (403) / false CORS

Project: tess-vercel-api
Plan: Hobby

Issue started suddenly without code changes or redeploy.

Symptoms:

Diagnostics:

  • Browser opening https://vercel.com/.well-known/openid-configuration returns JSON

  • Node fetch / curl returns:

    • 403 Forbidden

    • X-Vercel-Mitigated: challenge

  • Bot Protection is inactive

  • No custom firewall rules originally

  • Added bypass rule for /api/tessapp-apx, but issue persists

  • Firewall dashboard shows DDoS Mitigation challenges

This appears to be a false positive from Vercel DDoS mitigation affecting both project traffic and CLI/OIDC requests.

Requesting review/unblock or guidance.