Securing Vercel API tokens for code recovery

Why you need a token

Vercel Recovery uses the official REST API to list deployment files and download their contents. A bearer token proves you have access to the team and project you are recovering.

Token scope options

• Full account access — all personal projects and every team you belong to. Use only if you understand the blast radius.
• Personal account only — limits access to projects under your personal Vercel account.
• Specific team — best practice: scope the token to the single team that owns the project you are recovering.

What we store (and what we don't)

Your Vercel token is sent to our servers only to call the Vercel API during scan and download. It is not saved in our database. For convenience, the Recovery Console may remember form fields in your browser's local storage — clear it or use a private window if you prefer.

Recommended workflow

• Sign in, then create a token scoped to the relevant team
• Run a free scan, then Start recover (or buy a pack first if you need more tokens)
• Revoke the token at vercel.com/account/tokens
• Reconnect Git remotes before deploying again

Ready to recover? Free scan — sign in or read the emergency guide.