Configure Vercel enterprise SSO, role-based access control, and organization management. Use when implementing SSO integration, configuring role-based permissions, or setting up organization-level controls for Vercel. Trigger with phrases like "vercel SSO", "vercel RBAC", "vercel enterprise", "vercel roles", "vercel permissions", "vercel SAML".
/plugin marketplace add jeremylongshore/claude-code-plugins-plus-skills/plugin install vercel-pack@claude-code-plugins-plusThis skill is limited to using the following tools:
Configure enterprise-grade access control for Vercel integrations.
| Role | Permissions | Use Case |
|---|---|---|
| Admin | Full access | Platform administrators |
| Developer | Read/write, no delete | Active development |
| Viewer | Read-only | Stakeholders, auditors |
| Service | API access only | Automated systems |
enum VercelRole {
Admin = 'admin',
Developer = 'developer',
Viewer = 'viewer',
Service = 'service',
}
interface VercelPermissions {
read: boolean;
write: boolean;
delete: boolean;
admin: boolean;
}
const ROLE_PERMISSIONS: Record<VercelRole, VercelPermissions> = {
admin: { read: true, write: true, delete: true, admin: true },
developer: { read: true, write: true, delete: false, admin: false },
viewer: { read: true, write: false, delete: false, admin: false },
service: { read: true, write: true, delete: false, admin: false },
};
function checkPermission(
role: VercelRole,
action: keyof VercelPermissions
): boolean {
return ROLE_PERMISSIONS[role][action];
}
// Vercel SAML setup
const samlConfig = {
entryPoint: 'https://idp.company.com/saml/sso',
issuer: 'https://vercel.com/saml/metadata',
cert: process.env.SAML_CERT,
callbackUrl: 'https://app.yourcompany.com/auth/vercel/callback',
};
// Map IdP groups to Vercel roles
const groupRoleMapping: Record<string, VercelRole> = {
'Engineering': VercelRole.Developer,
'Platform-Admins': VercelRole.Admin,
'Data-Team': VercelRole.Viewer,
};
import { OAuth2Client } from 'vercel';
const oauthClient = new OAuth2Client({
clientId: process.env.VERCEL_OAUTH_CLIENT_ID!,
clientSecret: process.env.VERCEL_OAUTH_CLIENT_SECRET!,
redirectUri: 'https://app.yourcompany.com/auth/vercel/callback',
scopes: read, write, deploy,
});
interface VercelOrganization {
id: string;
name: string;
ssoEnabled: boolean;
enforceSso: boolean;
allowedDomains: string[];
defaultRole: VercelRole;
}
async function createOrganization(
config: VercelOrganization
): Promise<void> {
await vercelClient.organizations.create({
...config,
settings: {
sso: {
enabled: config.ssoEnabled,
enforced: config.enforceSso,
domains: config.allowedDomains,
},
},
});
}
function requireVercelPermission(
requiredPermission: keyof VercelPermissions
) {
return async (req: Request, res: Response, next: NextFunction) => {
const user = req.user as { vercelRole: VercelRole };
if (!checkPermission(user.vercelRole, requiredPermission)) {
return res.status(403).json({
error: 'Forbidden',
message: `Missing permission: ${requiredPermission}`,
});
}
next();
};
}
// Usage
app.delete('/vercel/resource/:id',
requireVercelPermission('delete'),
deleteResourceHandler
);
interface VercelAuditEntry {
timestamp: Date;
userId: string;
role: VercelRole;
action: string;
resource: string;
success: boolean;
ipAddress: string;
}
async function logVercelAccess(entry: VercelAuditEntry): Promise<void> {
await auditDb.insert(entry);
// Alert on suspicious activity
if (entry.action === 'delete' && !entry.success) {
await alertOnSuspiciousActivity(entry);
}
}
Map organizational roles to Vercel permissions.
Set up SAML or OIDC integration with your IdP.
Add permission checks to API endpoints.
Track all access for compliance.
| Issue | Cause | Solution |
|---|---|---|
| SSO login fails | Wrong callback URL | Verify IdP config |
| Permission denied | Missing role mapping | Update group mappings |
| Token expired | Short TTL | Refresh token logic |
| Audit gaps | Async logging failed | Check log pipeline |
if (!checkPermission(user.role, 'write')) {
throw new ForbiddenError('Write permission required');
}
For major migrations, see vercel-migration-deep-dive.