Protection Bypass for Automation

Help
1

Hi all! I’m facing unexpected behavior regarding Protection Bypass for Automation.

According to the docs - Protection Bypass for Automation - this feature should:

  1. Generate a secret
  2. Last on all deployments until revoked
  3. Be automatically added to deployments as a system environment variable (VERCEL_AUTOMATION_BYPASS_SECRET)

In my use case, NONE of the above is happening, which leads me to believe the documentation has gone stale. I see:

  1. A prompt to insert my own secret, not generated
  2. Immediately revoked after first use - this is the big problem. I can run my e2e tests once, after which my secret disappears from the UI.
  3. Not added to system environment variables whatsoever

I’ve carried out the steps manually to add the env myself and redeploy, but to no avail. The result is that running my tests for a second time are blocked by the Vercel SSO page.

Context

Use case: e2e tests with playwright
Target environment: preview
Vercel Plan: Pro

I’ve also noticed that the screenshots in the docs differ from what I’m seeing, so the docs are definitely stale (attached). Note the “Enabled” toggle missing.

Can anyone clarify what’s going on here? Anyone else have this issue?

image
image937×339 29.4 KB

image
image855×340 75 KB

2

The domain troubleshooting guide can help with most custom domain configuration issues. You might be able to use that guide to solve it before a human is available to help you. Then you can come back here and share the answer for bonus points.

You can also use v0 to narrow down the possibilities.

5

In addition, I am using the advanced configuration instructions.

await page.route('**/*', async (route) => {
  await route.continue({
    headers: {
      ...route.request().headers(),
      'x-vercel-protection-bypass': vercelBypassSecret,
      'x-vercel-set-bypass-cookie': 'samesitenone',  // <-- here
    },
  });
});

In a single e2e test, multiple requests are made and they succeed.

If I run the suite a second time, its as if the bypass secret never existed. Not visible in the UI either.