Vercel Access Token

Detects Vercel credentials: the current prefixed token family introduced in February 2026 (vcp_ personal access tokens, vci_ integration tokens, vca_ app access tokens, vcr_ app refresh tokens, vck_ API keys), Vercel Blob read-write tokens (vercel_blob_rw_), and, when labelled with Vercel context in an assignment, the legacy unprefixed 24-character token form. A leaked token grants control of the account's projects, deployments and environment variables; a leaked Blob token grants read/write access to the associated storage.

Type: regex
Engine: universal
Confidence: high
Confidence justification: High confidence: the vc?-prefix family is documented by Vercel's own changelog (all five prefixes named, introduced specifically so scanners can detect them), corroborated by literal vca_/vcr_ token examples in Vercel's own Sign in with Vercel docs (56-character alphanumeric bodies), and Vercel is a GitHub secret-scanning partner with six token types, five push-protection enabled. Exact per-prefix body lengths are not formally published, so an honest bounded 40-80 range is used. The legacy unprefixed form is deliberately context-gated: it is indistinguishable from other 24-character identifiers (GitGuardian lists it as non-prefixed), so it requires a labelled assignment and never fires value-only.
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: CIS Controls, ISO 27001, NIST CSF, SOC 2
Data categories: credentials, security
Scope: narrow
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Unsupported, Macie: Unsupported, Zscaler: Compatible, Palo Alto: Unsupported, Netskope: Unsupported

Pattern

(?<![A-Za-z0-9_])(?:vc[aikpr]_[A-Za-z0-9]{40,80}|vercel_blob_rw_[A-Za-z0-9]{5,40}_[A-Za-z0-9]{10,60})(?![A-Za-z0-9_])

Corroborative evidence keywords

vercel, vercel.com, VERCEL_TOKEN, deployment, api key, api_key, apikey, access key, access token, auth token, authorization, bearer, conn str, connection string, connectionstring, cookie, credential, database, host, [object Object] (+37 more)

Proximity: 300 characters

Should match

vca_zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA9876 — Exact 65 probe - current app token without independent deployment context
Vercel deployment credential vck_0123456789ABCDEFGHIJ0123456789abcdefghij — Exact 75 probe - API-key structure with deployment context
Vercel project deploy secret VERCEL_TOKEN=vcp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz01234567 — Exact 85 probe - project context plus canonical token assignment
BLOB_READ_WRITE_TOKEN=vercel_blob_rw_abc123_ABCDEFGHIJKLMNOPQRSTUVWXYZ — Vercel Blob read-write token (vercel_blob_rw_ + store id + secret)
vercel_blob_rw_store01_zyxwvutsrqponmlkjihgfedcba0123456789 — Bare Vercel Blob token (distinctive prefix, no label needed)
VERCEL_TOKEN=ABCDEFGHIJKLMNOPQRSTUVWX — Legacy unprefixed Vercel token (24 chars) in a labelled assignment
vercel api token: zyxwvutsrqponmlkjihgfedc — Legacy context-gated token retained as a discovery candidate

Should not match

vercel_deploy_id_ABCDEFGHIJKLMNOPQRSTUVWX_env_more — 24-char run glued inside a longer identifier (boundary regression case from review)
vcx_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz01234567 — Invalid prefix letter (vcx_ is not a Vercel token family)
vcp_ABCDEFGHIJ0123456789 — vcp_ body too short (20 chars, below the 40-char floor)
ABCDEFGHIJKLMNOPQRSTUVWX with no vendor context — Bare 24-char alphanumeric value with no Vercel label anywhere (could be any ID or hash)
vercel_blob_rw_abc_Zz9 — Blob token secret segment far too short (3 chars, below the 10-char floor)
Netlify deploy NETLIFY_AUTH_TOKEN=vcp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz01234567 — Sibling deployment provider context does not corroborate a Vercel token
Documentation example: Vercel project VERCEL_TOKEN=vcp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz01234567 — Documentation example containing a valid-shaped token is excluded
rotate the vercel token in account settings — Prose mention without a token value
template example placeholder record identifier — Template/sample context should be excluded even when anchor words are present

Known false positives

A 24-character identifier (for example a MongoDB ObjectId is 24 hex characters) appearing in a labelled assignment near the word "vercel" in configuration or logs. Mitigation: The legacy branch requires label adjacency plus an assignment separator (already enforced by the regex) and corroborative keywords; it is context-gated only and never fires value-only.
Documentation or examples showing placeholder vcp_/VERCEL_TOKEN/vercel_blob_rw_ strings. Mitigation: Check for placeholder markers (example, xxxx, 0000) and documentation file types to reduce false positives.
The per-prefix body lengths of the vc?-family are not individually published; a bounded 40-80 range around the vendor-documented 56-character examples is used, and the possible sixth partner type (support access tokens) has no published prefix and is not matched. Mitigation: Documented as an honest bound; the prefixes themselves are vendor-announced and highly distinctive.

References

Collections

Cloud Credentials & API Keys