Vercel Integration with iCompaas

1. What are we integrating, and what's our goal?

  • Suppose the customer hosts their applications on Vercel.
  • iCompaas connects to their Vercel Team with read-only access. It discovers the team, projects, domains and deployments, and evaluates the security and compliance controls.
  • Vercel connects through OAuth. The customer doesn't create API keys or paste tokens. They sign in to Vercel and approve access.

2. Prerequisites

  • A Vercel Team. Personal accounts can't be connected.
  • A Vercel user who is allowed to install integrations on that Team.
  • At least one project in the Team.
  • Integration was installed with "All projects" selected, not "Specific projects"
  • Signed in to iCompaas in the same browser, with pop-ups allowed.

3. The Complete Onboarding Flow

  • Let's say the customer is Zato, and Zato runs its applications on a Vercel Team.
  • In iCompaas, the customer goes to Onboarding → Application onboarding, selects Vercel and clicks "Connect".
  • In the dialog, they can enter a connection name, such as "Vercel production". Then they click "Continue".
  • A Vercel pop-up opens. The customer signs in to Vercel and selects the Team to connect.
  • Under project access, they choose "All Projects". Access to only some projects isn't supported.
  • They review the read-only permissions and confirm the installation.
  • Vercel sends the browser back to iCompaas. iCompaas exchanges the authorization code for an access token and securely saves the connection with the Vercel Team ID and Configuration ID.
  • The pop-up closes, and iCompaas shows "Vercel connected."
  • iCompaas then validates the connection. It checks that the Team can be reached, the installation is complete, all projects are included, and the Team has at least one project.
  • Once validation passes, the connection is marked valid and the first scan starts automatically.

4. What iCompaas Checks

  • Team: SAML SSO enabled and enforced, directory sync, least-privilege member roles, no stale invitations.
  • Projects: deployment protection (including production), password protection, Git fork protection, skew protection, directory listing disabled, system environment variables not exposed automatically.
  • Deployments: production deployments use a stable target.
  • Domains: verified, valid SSL certificate, correct DNS configuration.

5. Troubleshooting

  • "Your browser blocked the connect popup": allow pop-ups for iCompaas and click Connect again.
  • "This Vercel account is not part of a Team": install again and select a Vercel Team.
  • "Please sign in to iCompaas first": sign in to iCompaas in the same browser, then reconnect.
  • Connection shows as invalid: in Vercel, set the integration's project access to All Projects, or add a project to the Team. Then reconnect.
  • Same Team connected again: iCompaas refreshes that Team's existing connection and doesn't create a duplicate.