@reaatech/secret-rotation-provider-vercel

Status: Pre-1.0 — APIs may change in minor versions. Pin to a specific version in production.

Vercel project environment variable provider for Secret Rotation Kit. Implements the SecretProvider interface against the Vercel REST API using the built-in fetch — no SDK dependency.

Installation

npm install @reaatech/secret-rotation-provider-vercel
# or
pnpm add @reaatech/secret-rotation-provider-vercel

Requires Node.js >= 20 (for global fetch).

Feature Overview

• Full SecretProvider implementation — CRUD, rotation sessions, and health checks
• No dependencies — talks to the Vercel REST API directly via fetch
• Target-aware — writes to one or more deployment targets (production, preview, development)
• Verification-friendly — uses the encrypted env var type by default so values are readable for propagation verification

Quick Start

import { VercelProvider } from '@reaatech/secret-rotation-provider-vercel';
import { RotationManager } from '@reaatech/secret-rotation-core';
 
const provider = new VercelProvider({
  token: process.env.VERCEL_TOKEN,
  projectId: 'prj_xxxx…', // project id or name
  teamId: process.env.VERCEL_TEAM_ID, // omit for a personal account
  target: ['production'],
});
 
const manager = new RotationManager({ providerInstance: provider });
await manager.rotate('DATABASE_URL');

How it maps to Vercel

Vercel has no native secret versioning or staging — a key has one value per target, and the env var id is stable across updates. This provider therefore:

• uses the env var id as the version identifier, so propagation verification (which re-reads the value) succeeds once the new value is live;
• captures the previous value in the rotation session so a failed rotation can be rolled back (Vercel keeps no history);
• writes with the encrypted type by default so the value can be read back for verification. sensitive env vars are write-only — if you choose that type, pair it with a custom/active verifier.

Propagation note: Vercel env var changes take effect on the next deployment. The provider confirms the new value is readable via the API; live propagation to running deployments depends on a redeploy.

API Reference

VercelProvider

Constructor

new VercelProvider(config: VercelProviderOptions, fetchImpl?: typeof fetch)

Pass a custom fetch (second argument) to route requests through a proxy or a test double; it defaults to the global fetch.

VercelProviderOptions

SecretProvider Methods

Related Packages

• @reaatech/secret-rotation-types — SecretProvider interface and config types
• @reaatech/secret-rotation-core — Rotation engine
• @reaatech/secret-rotation-provider-aws — AWS adapter

License

MIT