Thanks for the suggestion! I'll pass it along to the team. 😄

I also want to make sure you're aware that it's currently possible to create multiple access tokens scoped to teams. You can set them up with expiration dates or manually delete anytime. So you could create separate tokens for each project with team-level scope to use with individual projects.

Thanks, @amyegan!

Unfortunately, this doesn't help, since our goal is to restrict access to specific projects and hence lower the attack surface by allowing only a few people from our team to deploy to all Vercel projects.

The more I think about this feature, the more I realize how important it is for protecting your customers from hacker attacks.

Recently, the crypto industry suffered a major hack—$1.5 billion was lost because a developer's AWS session key was stolen. The atacker was a state-sponsored hacking group.

If a similar attacker were to obtain a large organization's VERCEL_TOKEN, they could easily inject a malicious version of its website.

Given this risk, I think that project-scoped tokens should be a high-priority addition to your roadmap.

I just confirmed with the engineering team that this is on the roadmap. I don't have an estimated release date yet, but we're already working on it.

Keep an eye on the changelog for an announcement when it becomes available.

I was just searching for this feature today... and according to AI Overview the feature exists... but this seems to be incorrect. Looks like you can do this on a personal account?

Anyway, this would be an amazing improvement! thx

This is still in development 😃

It would be very useful, i was searching too. Any update on the implementation? Thanks!

Hello, could we please consider bumping the priority here? This is a self contained feature that would simultaneously reduce the attack vector elegantly laid out above, but also allow for reducing deployment friction for experiments and other projects to be safely conducted.

I agree with @lintile-actual. It’s been a year already and this hasn’t been implemented.

I am here again, as a security professional, imploring you all to consider expediting this work. Right now, EVERY vercel CLI can affect EVERY app on an account. If we need to scope access to non-prod apps vs prod apps in an account, we have to simply just not choose to do it. This is a hard blocker, and there is no reasonable way to scope access to certain apps.

Seems like there is an --project option in docs, but it does not work Error: projectId is not supported (400)