# Vercel deploy hook

After a deploy, file one claim that the new page is the one you just shipped. On Vercel, Team OIDC replaces a stored key. The global issuer (`https://oidc.vercel.com` with no team) is refused. Set the project's OIDC issuer mode to Team.

Locally, the same file uses `COUNTERSIGN_API_KEY`.

```bash
export COUNTERSIGN_URL="${COUNTERSIGN_URL:-http://127.0.0.1:8787}"
export COUNTERSIGN_API_KEY="${COUNTERSIGN_API_KEY:?set a csk_ key}"
export DEPLOY_URL="${DEPLOY_URL:-https://example.com/}"
export CHECK_CONTAINS="${CHECK_CONTAINS:-Example Domain}"
node docs/quickstart/vercel.mjs
```

`contains` has to be text only the new deploy shows (a version string, a heading). A bare 200 stays capped unless the statement says the page is live.

On Vercel, omit `COUNTERSIGN_API_KEY`. The script calls `getVercelOidcToken({ audience: "countersign.signalry.ai" })` from `@vercel/oidc` when `VERCEL` is set. Install that package in the Vercel project; this repository does not depend on it. The claim is attributed to `vercel:<team>/<project>`.

To file under an agent's own track record instead, bind the project once: `POST /v1/agents/me/bindings` with the agent's `csk_` key and a fresh project token (`skipCache: true`). See `/start#vercel`.

A GitHub Actions deploy job that does not run on Vercel should use the Action (`/quickstart/github-actions`) rather than this script.