> ## Documentation Index > Fetch the complete documentation index at: https://support.configview.com/llms.txt > Use this file to discover all available pages before exploring further. # Vercel setup ConfigView reads your Vercel team through the Vercel REST API (`https://api.vercel.com`), using an **access token** that someone on the team creates in Vercel. ConfigView sends only `GET` requests. It never creates, changes or deletes anything in Vercel. You will end up with **2 required secrets** (`VERCEL_API_TOKEN`, `VERCEL_TEAM_ID`) in ConfigView when setup is complete. > **Scope of this integration today.** ConfigView reads who is on your Vercel team and in which role, pending invites, who has access to each project and through which access groups, each project's deployment protection (Vercel Authentication and password protection), firewall and attack mode settings, the team's SAML single sign-on and SCIM settings, environment variable **names and types** (never values), installed integrations with the scopes they hold, domains and their expiry, and the webhooks and drains that send data out of Vercel. It also keeps a running history of the team's activity feed (role changes, invites, token and integration changes). It does not read deployments, build or runtime logs, source code, environment variable values or billing data. *** ## Read this first: Vercel tokens cannot be read-only Vercel has no read-only access token and no scopes on a token. A token can do **everything the user who created it can do** in the team it is scoped to. Anyone who gets hold of the token could, in principle, change settings or delete projects, even though ConfigView itself only ever reads. What you can do about it: * Create the token from a **dedicated user** (for example `configview@yourcompany.com`) rather than from a person's account, so it does not stop working when someone leaves. * Give that user the **lowest team role that still lets everything below work**. Vercel does not publish which role each endpoint needs, so start with **Member** and use **Verify now** (step 4). If a check says it is not available, that area needs a higher role; decide whether you want it. Do not use Owner unless you need the activity feed. * Set the token's **Scope** to the one team you want ConfigView to read, never **Full Account**. * Choose an **expiration**, and put a reminder in your calendar to replace the token before it lapses. An expired token makes every collector fail with a 401. *** ## What you need * A Vercel team (any plan). Pro and Enterprise teams have more to read: access groups, SAML and SCIM, and the activity feed depend on your plan and the user's role. If an area is not available, that collector skips itself and its table stays empty. That does not count as a failure. * Someone who can add a user to the team and create a token *** ## Step 1: Open the Vercel page in ConfigView Open ConfigView in a second browser tab and leave it open: `https://{companyname}.configview.com/admin/integrations/vercel` *** ## Step 2: Add the user and create the token 1. In Vercel open your team, then **Settings → Members → Invite** and invite the dedicated user with the role you chose above. Accept the invite as that user. 2. Signed in as that user, open **Account Settings → Tokens** (`https://vercel.com/account/tokens`) 3. Enter the name `ConfigView` 4. Under **Scope** choose your team (not **Full Account**) 5. Pick an **Expiration** and click **Create** 6. Copy the token now. Vercel shows it only once. 7. In the ConfigView tab paste it into `VERCEL_API_TOKEN` under **Credentials** and click the save icon *** ## Step 3: Add the team ID 1. In Vercel open your team's **Settings → General** 2. Copy the **Team ID**. It starts with `team_`. The team slug (the name in your dashboard address) also works. 3. Paste it into `VERCEL_TEAM_ID` in ConfigView and click the save icon *** ## Step 4: Connect and verify 1. Click **Connect**. ConfigView creates its tables and schedules every collector at your default run time. Stop any you don't want under **Collectors**: | Script | Notes | | - | - | | **Team Settings** | Plan, SAML and SCIM, member policies, sensitive environment variable policy, team-wide protection defaults. | | **Members and Invites** | Everyone on the team with their role, and pending email invites. | | **Projects** | Every project with its Git repository, deployment protection, firewall and latest deployment. | | **Project Members** | Who has access to each project, at which role. Makes one request per project. | | **Access Groups** | Groups, their members and projects. Skipped if your plan has none. | | **Environment Variables** | Names, types and targets of project and shared variables. Makes one request per project. Values are never read. | | **Domains** and **Project Domains** | Team domains with expiry, and which domain serves which project. | | **Installed Integrations** | Integrations and Marketplace products, with their scopes. | | **Webhooks** and **Drains** | Where Vercel sends events, logs and traces. Host only. | | **Audit Events** | The activity feed, kept as a history. Skipped if the token's user cannot read it. | 2. Click **Verify now**. The health check reads both secrets, reads the team, then tries one small request for every area. If a check fails: * **Team fails with 401.** The token is wrong, expired or was revoked. Create a new one. * **Team fails with 403 or 404.** The token is scoped to a different team than `VERCEL_TEAM_ID`, or the user is not in the team. * **Members, Projects, Domains, Integrations, Webhooks or Drains fail with 403.** The token's user has a role that cannot read that area. Give the user a higher role, or accept the gap. * **Access groups or the activity feed show as skipped.** Your plan or the user's role does not include them. Nothing to fix unless you want that area. *** ## Data Tables Once the scripts run, these tables are created in your database. Each table has a `run_at` column. Every table except `vercel_audit_events` keeps only the newest run; `vercel_audit_events` keeps its history. | Table | Source | Key Columns | | - | - | - | | `vercel_team` | `GET /v2/teams/{teamId}` | team\_id, plan, saml\_enforced, scim\_connected\_at, new\_member\_policy, sensitive\_env\_policy, default\_sso\_protection, strict\_deployment\_protection | | `vercel_members` | `GET /v3/teams/{teamId}/members` | member\_uid, email, username, role, confirmed, joined\_origin, sso\_connected, scim\_managed, project\_count | | `vercel_invites` | `GET /v3/teams/{teamId}/members` (`emailInviteCodes`) | email, role, expired, invited\_at | | `vercel_projects` | `GET /v10/projects` | project\_id, name, framework, git\_provider, git\_repo, sso\_protection, password\_protection, firewall\_enabled, deploy\_hook\_count, last\_deployed\_at | | `vercel_project_members` | `GET /v1/projects/{id}/members` | project\_id, email, project\_role, computed\_project\_role, team\_role | | `vercel_access_groups` | `GET /v1/access-groups` | group\_id, name, members\_count, projects\_count, is\_scim\_managed | | `vercel_access_group_members` | `GET /v1/access-groups/{id}/members` | group\_id, email, team\_role | | `vercel_access_group_projects` | `GET /v1/access-groups/{id}/projects` | group\_id, project\_id, project\_role | | `vercel_env_vars` | `GET /v10/projects/{id}/env` | project\_id, env\_key, env\_type, is\_plaintext, is\_sensitive, targets, updated\_at | | `vercel_shared_env_vars` | `GET /v1/env` | env\_key, env\_type, is\_plaintext, targets, project\_count | | `vercel_domains` | `GET /v5/domains` | domain, verified, auto\_renew, expires\_at, nameservers, creator\_email | | `vercel_project_domains` | `GET /v9/projects/{id}/domains` | project\_id, domain, verified, redirect\_target, git\_branch | | `vercel_integrations` | `GET /v1/integrations/configurations` | slug, integration\_name, status, scopes, all\_projects, project\_count, installed\_by\_uid | | `vercel_webhooks` | `GET /v1/webhooks` | webhook\_id, target\_host, events | | `vercel_drains` | `GET /v1/drains` | drain\_id, delivery\_type, target\_host, status, data\_types, delivery\_state | | `vercel_audit_events` | `GET /v3/events` | event\_id, created\_at, event\_type, actor\_email, event\_text | *** ## Things worth knowing **Deployment protection is the main thing to watch.** A project whose `sso_protection` is empty has no Vercel Authentication, so its preview deployments (and, depending on the setting, production URLs) are open to anyone with the address. `vercel_team.default_sso_protection` is the default new projects get. **Plain versus sensitive variables.** `env_type` is `plain` (readable in the dashboard by anyone with access), `encrypted`, or `sensitive` (cannot be read back after it is saved). `is_plaintext` marks the first kind. Variable names that look like keys or passwords and are stored as `plain` are worth a look. **Integrations hold scopes.** Each installed integration lists the permission scopes it was granted and whether it can reach all projects. Review the ones you no longer use. **Invite and member roles.** `OWNER` can change anything; `MEMBER` and `DEVELOPER` can deploy; `VIEWER`, `BILLING` and `SECURITY` are narrower. Pending invites are shown with the role they would receive. **Tokens other people created are not visible.** The Vercel API lists only the token owner's own tokens, so ConfigView cannot show who else on the team holds a personal access token. The activity feed records when tokens are created or deleted. **The activity feed.** Audit Events are collected from the first run back 90 days, then every run adds what is new. Routine events (deployments, aliases, scaling) are left out. Vercel's full audit log export is a separate Enterprise feature; this is the team activity feed available through the API. **Rate limit.** Vercel publishes per-action limits (for example 500 requests a minute to read a project's environment variables) and no single figure for the list endpoints. ConfigView paces itself at 60 requests a minute (120 for environment variables) and waits as long as Vercel asks after an HTTP 429. Project Members, Environment Variables and Project Domains make one request per project, so they take a few minutes on a team with hundreds of projects. ## What isn't collected * Environment variable values (the API returns them for plain variables and as ciphertext for encrypted ones; ConfigView never reads that field) * Deploy hook URLs (only how many a project has), the team's invite link code, the password-protection password, and the SAML role mapping * Drain headers and secrets, and the path or query of any drain or webhook address. Only the host is stored * Deployments, build and runtime logs, source code, Edge Config contents, Blob and database data * Billing and invoices This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.