← Back to home

Vercel Integration

Sync E2E encrypted secrets to Vercel environment variables. Two options: browser-based OAuth or CLI.

Option 1: Browser Integration (Recommended)

One-click setup from the Vercel Marketplace. No tokens to manage.

  1. Install MeowPass on Vercel Marketplace →
  2. Authorize MeowPass to access your Vercel projects
  3. Configure project mappings → — map a vault to a Vercel project and environment
  4. Use mp vercel sync or the dashboard to push secrets
Install on VercelConfigure Mappings

Option 2: CLI Sync

Push secrets directly from the command line. Requires a Vercel API token.

bash
# Push production secrets to Vercel mp vercel sync --project my-app --env production # With explicit token mp vercel sync --project my-app --env production --vercel-token $VERCEL_TOKEN

Prerequisites

  1. MeowPass CLI installed: brew install meowrithm/tap/meowpass
  2. Logged in: mp login
  3. Project initialized: mp init
  4. Vercel API token — get one from vercel.com/account/tokens

Environment Mapping

MeowPass environments map to Vercel targets automatically:

MeowPass envVercel target
productionproduction
preview / stagingpreview
default / local / developmentdevelopment

Override with --target production to force a specific Vercel target.

Usage

Sync production secrets

bash
mp vercel sync --project my-nextjs-app --env production

Sync to a team project

bash
mp vercel sync --project my-app --env production --vercel-team my-team

Dry run (preview changes)

bash
mp vercel sync --project my-app --env production --dry-run

Sync all environments

bash
mp vercel sync --project my-app --env default mp vercel sync --project my-app --env preview mp vercel sync --project my-app --env production

GitHub Actions + Vercel

Sync secrets to Vercel before every deploy:

.github/workflows/deploy.yml
name: Deploy on: push: branches: [main] jobs: deploy: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Install MeowPass run: | curl -fsSL https://github.com/meowrithm/meowpass-releases/releases/latest/download/meowpass_linux_amd64.tar.gz | tar xz sudo mv meowpass /usr/local/bin/mp - name: Sync secrets to Vercel env: MEOWPASS_TOKEN: ${{ secrets.MEOWPASS_TOKEN }} VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }} run: mp vercel sync --project my-app --env production - name: Deploy run: npx vercel --prod --token ${{ secrets.VERCEL_TOKEN }}

Flags Reference

FlagDescription
--projectVercel project name or ID (required)
--envMeowPass environment (default, local, production, etc.)
--vercel-tokenVercel API token (or VERCEL_TOKEN env var)
--vercel-teamVercel team slug (for team projects)
--targetOverride Vercel target (production, preview, development)
--vaultOverride vault ID
--dry-runPreview without pushing

How It Works

  1. Pulls encrypted secrets from your MeowPass vault
  2. Decrypts locally using your master key (zero-knowledge — server never sees plaintext)
  3. Pushes each secret to Vercel as an encrypted environment variable via their REST API
  4. Creates new vars or updates existing ones (matched by key name)

Vercel stores env vars encrypted at rest. The plaintext only exists in memory during the sync and during Vercel builds.