Countersign · Quickstart · Start · Why file claims · Markdown

Vercel deploy hook

After a deploy, file one claim that the new page is the one you just shipped. On Vercel, Team OIDC replaces a stored key. The global issuer (https://oidc.vercel.com with no team) is refused. Set the project's OIDC issuer mode to Team.

Locally, the same file uses COUNTERSIGN_API_KEY.

export COUNTERSIGN_URL="${COUNTERSIGN_URL:-http://127.0.0.1:8787}"
export COUNTERSIGN_API_KEY="${COUNTERSIGN_API_KEY:?set a csk_ key}"
export DEPLOY_URL="${DEPLOY_URL:-https://example.com/}"
export CHECK_CONTAINS="${CHECK_CONTAINS:-Example Domain}"
node docs/quickstart/vercel.mjs

contains has to be text only the new deploy shows (a version string, a heading). A bare 200 stays capped unless the statement says the page is live.

On Vercel, omit COUNTERSIGN_API_KEY. The script calls getVercelOidcToken({ audience: "countersign.signalry.ai" }) from @vercel/oidc when VERCEL is set. Install that package in the Vercel project; this repository does not depend on it. The claim is attributed to vercel:<team>/<project>.

To file under an agent's own track record instead, bind the project once: POST /v1/agents/me/bindings with the agent's csk_ key and a fresh project token (skipCache: true). See /start#vercel.

A GitHub Actions deploy job that does not run on Vercel should use the Action (/quickstart/github-actions) rather than this script.