Standing up Vercel Pro, the IT way.
A short, practical walkthrough of the settings that matter most to an admin: who gets access, how secrets are protected, and what to lock down before the team starts shipping.
Team & user management
Every person on the team gets a role, and the role decides what they can touch. Assign the narrowest role that lets someone do their job — you can always widen it later.
| Role | Can do | Notes |
|---|---|---|
| Owner | Everything — billing, team settings, invites, removals, all projects. | Keep this to 1–2 trusted admins. |
| Member | Create deployments, manage domains and integrations across all projects. | Standard paid seat, $20/mo. |
| Developer | Create non-production (preview) deployments across projects. | Available on Pro and Enterprise. |
| Security | Manage security settings and secrets, no deploy permissions by default. | Mainly an Enterprise role. |
| Billing | Manages invoices and billing only — no project access. | Good for finance stakeholders. |
| Contributor | Access only to projects explicitly assigned to them. | Fits contractors and cross-team help. |
| Viewer | Read-only dashboard access, can comment on previews. | Free — doesn't count as a paid seat. |
Inviting members
From Team Settings→Members→Invite, add an email, assign a role, and send. Invites expire after 24 hours. Pending invites already count against your seat total.
Removing access
There's no "deactivate" state — removing someone is a hard removal from the team. If SSO is enforced, de-provisioning a user at your identity provider removes them from Vercel automatically via SCIM.
Security settings
Most of what used to be Enterprise-only identity and compliance tooling is now a self-serve add-on on Pro. Worth turning on early, before real projects and data show up.
SAML SSO
Enforce sign-in through your identity provider instead of individual passwords. No sales call needed — enable it directly from team security settings.
HIPAA BAA
Self-serve compliance add-on if the team will touch protected health information.
Fork PR protection
Deployments triggered from a pull request on a forked repo require manual authorization by default, so a stranger's PR can't quietly exfiltrate your env vars.
OIDC federation
Issue short-lived, auto-rotating tokens to backend services instead of handing out long-lived static secrets.
Secrets hygiene
- Mark long-lived secrets as Sensitive — once saved, the value can never be read back through the dashboard or API again, only rotated.
- Turn on sensitive-by-default in Security & Privacy so every new Production and Preview variable is protected automatically, team-wide.
- Never prefix a real secret with
NEXT_PUBLIC_— that prefix ships the value straight into the browser bundle. - Vercel automatically redacts sensitive values 32 characters or longer from build logs — shorter secrets won't be masked, so keep an eye on those manually.
vercel.json or your framework config as part of onboarding, not as an afterthought.
Domains & environment variables
Variables are scoped per environment, and Pro adds a shared layer so one value can feed many projects.
| Runtime | Limit |
|---|---|
| Node.js, Python, Ruby, Go, Java, .NET | 64 KB total per deployment (also the max for a single value) |
| Edge runtime | 5 KB per variable |
Shared environment variables
Create one at the team level and link it to any number of projects — updating the shared value updates every linked project at once. A project-level variable with the same name overrides it locally.
Free first-year domain
New Pro upgrades get one eligible domain (.online, .site, .space, .store, .tech, or .website) free for the first year — claim it within 30 days, it doesn't carry over once that window closes.
Deployment protection
Preview URLs are reachable by anyone with the link unless you explicitly lock them down — easy to forget once a project has been live for a while.
| Tier | What it covers | Availability |
|---|---|---|
| Standard | Restricts generated preview URLs (and optionally production-generated URLs) from public access. | Included on Pro |
| Advanced | Adds trusted IP allowlisting and finer bypass controls for automation. | $150/mo add-on on Pro · default on Enterprise |
Vercel Authentication
Require a Vercel login to view a preview deployment — the fastest way to keep staging data away from outsiders.
Password protection
Set a shared password for previews when a login requirement is more friction than the situation calls for.
vercel.json first — protection exists specifically to stop those from leaking.
Billing & usage
Pro bills per seat plus a shared usage credit, with guardrails on by default so a traffic spike doesn't turn into a surprise invoice.
| Item | Cost |
|---|---|
| Owner / Member seat | $20/month each |
| Viewer seat | Free, unlimited |
| Included usage credit | $20/month, shared across the team |
| SAML SSO add-on | $300/month |
| HIPAA BAA add-on | $350/month |
| Advanced Deployment Protection add-on | $150/month |
Launch checklist
Tap an item to mark it done. Nothing here is saved between visits — it's meant to be worked through once, in order, during setup.
- Set team roles before adding peopleDecide who needs Owner vs. Member vs. Viewer before sending invites.
- Claim the free first-year domainOnly valid within 30 days of upgrading to Pro.
- Turn on SAML SSO if your org requires itSelf-serve add-on — no need to loop in sales.
- Move every secret into Environment VariablesNothing sensitive belongs in the repo, ever.
- Mark long-lived secrets as SensitiveAnd enable sensitive-by-default team-wide.
- Audit NEXT_PUBLIC_ variablesConfirm nothing secret is riding that prefix into the browser.
- Lock preview deploymentsVercel Authentication or password protection, before a client sees a broken staging build.
- Add security headersCSP, HSTS, X-Frame-Options — Vercel won't add these for you.
- Review Access Groups quarterlyPeople change teams; project access should follow.
- Watch the spend management alertsDon't let the default thresholds be the first time you see a number.