Vercel Integration

Sync your secrets to Vercel environment variables. Two options: browser-based OAuth or CLI.

Option 1: Browser Integration (Recommended)

One-click setup from the Vercel Marketplace. No tokens to manage.

Install MeowPass on Vercel Marketplace →
Authorize MeowPass to access your Vercel projects
Configure project mappings → to map a vault to a Vercel project and environment
Use mp vercel sync or the dashboard to push secrets

Install on Vercel Configure Mappings

Option 2: CLI Sync

Push secrets directly from the command line. Requires a Vercel API token.

bash

# Push production secrets to Vercel mp vercel sync --project my-app --env production # With explicit token mp vercel sync --project my-app --env production --vercel-token $VERCEL_TOKEN

Prerequisites

MeowPass CLI installed: brew install meowrithm/tap/meowpass
Logged in: mp login
Project initialized: mp init
Vercel API token, get one from vercel.com/account/tokens

Environment Mapping

MeowPass environments map to Vercel targets automatically:

MeowPass env	Vercel target
production	production
preview / staging	preview
default / local / development	development

Override with --target production to force a specific Vercel target.

Usage

Sync production secrets

bash

mp vercel sync --project my-nextjs-app --env production

Sync to a team project

bash

mp vercel sync --project my-app --env production --vercel-team my-team

Dry run (preview changes)

bash

mp vercel sync --project my-app --env production --dry-run

Sync all environments

bash

mp vercel sync --project my-app --env default mp vercel sync --project my-app --env preview mp vercel sync --project my-app --env production

GitHub Actions + Vercel

Sync secrets to Vercel before every deploy:

.github/workflows/deploy.yml

name: Deploy on: push: branches: [main] jobs: deploy: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Install MeowPass run: | curl -fsSL https://github.com/meowrithm/meowpass-releases/releases/latest/download/meowpass_linux_amd64.tar.gz | tar xz sudo mv meowpass /usr/local/bin/mp - name: Sync secrets to Vercel env: MEOWPASS_TOKEN: ${{ secrets.MEOWPASS_TOKEN }} VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }} run: mp vercel sync --project my-app --env production - name: Deploy run: npx vercel --prod --token ${{ secrets.VERCEL_TOKEN }}

Flags Reference

Flag	Description
--project	Vercel project name or ID (required)
--env	MeowPass environment (default, local, production, etc.)
--vercel-token	Vercel API token (or VERCEL_TOKEN env var)
--vercel-team	Vercel team slug (for team projects)
--target	Override Vercel target (production, preview, development)
--vault	Override vault ID
--dry-run	Preview without pushing

Auto-sync (on change)

Map a vault environment to a Vercel project once, and every secret change is pushed to Vercel automatically, with no manual mp vercel sync. Setting a secret creates/updates the matching Vercel env var; deleting it removes it.

One-time mapping

# Map the vault's production env → a Vercel project's production target. # (Configured on the Vercel integration; the browser flow sets this up for you.) # vault_id → project (name or prj_ id) → target # After that, writes auto-sync: mp set STRIPE_KEY sk_live_... --env production # → appears in Vercel mp delete OLD_KEY --env production # → removed from Vercel

Auto-sync is best-effort and never blocks your write. MeowPass stays the source of truth; Vercel is kept in sync.

Build-time pull

Prefer secrets to never live in Vercel's store? Pull them fresh at build time instead. Add a scoped API key as a Vercel env var and pull in your build command.

Vercel build command

# Project Settings → Environment Variables (Build): # MEOWPASS_TOKEN = mp_... (a read-only key) # MEOWPASS_VAULT_ID = <vault id> # Build Command: curl -fsSL https://meowpass.dev/install.sh | bash \ && mp pull --vault $MEOWPASS_VAULT_ID \ && npm run build

Secrets are pulled into the build environment and never stored in Vercel. Use a read-only key.

How It Works

Pulls your secrets from your MeowPass vault (decrypted server-side, over TLS)
Pushes each secret to Vercel as an encrypted environment variable via their REST API
Creates new vars or updates existing ones (matched by key name)

Vercel stores env vars encrypted at rest. The plaintext only exists in memory during the sync and during Vercel builds.