vercel-mauth

Multiple Vercel CLI accounts on one machine, without logging out and in.

• Log in to each account once. The login is saved as a named profile.
• Logins live in the OS keychain: macOS Keychain, Linux Secret Service (GNOME Keyring, KWallet), Windows Credential Manager. Nothing secret is written to disk in plain text.
• In a linked project, the right account is picked from .vercel/project.json, so vercel-mauth deploy --prod just works.
• Ships a Claude Code skill so Claude deploys with the right account too.

Install

Requires Node 18+ and the Vercel CLI (npm i -g vercel).

npm i -g github:mindantic/vercel-mauth
vercel-mauth install-skill

Optional, so plain vercel goes through it (add to ~/.zshrc or ~/.bashrc):

alias vercel=vercel-mauth

Use an alias, not a script named vercel on your PATH; the tool stops if it detects it would call itself.

Add accounts

vercel-mauth add uplayer
vercel-mauth add shotmark

Each add opens the normal Vercel browser login. Sign in with the account you want, and the tool saves:

• the login (access token, refresh token, expiry) in the keychain, under the service vercel-mauth and the profile name
• the account and every team it can reach in ~/.config/vercel-mauth/profiles.json (no secrets)

Running add again with the same name replaces that profile's login.

Use

vercel-mauth deploy --prod        # profile picked from .vercel/project.json
vercel-mauth which                # which profile this folder uses, and why
vercel-mauth use shotmark link    # link a new project with a specific account
vercel-mauth list                 # all profiles and their teams
vercel-mauth sync                 # refresh team lists after joining a team
vercel-mauth default uplayer      # profile used outside linked projects
vercel-mauth remove shotmark      # delete the profile and its keychain entry
VERCEL_MAUTH_PROFILE=uplayer vercel-mauth env ls

Resolution order: VERCEL_MAUTH_PROFILE, then the profile that can reach the linked project's team, then the default profile, then your regular vercel login. Commands that pass --token or --global-config go straight to vercel.

How it works

For every run, the tool creates a private temporary folder, writes the profile's login into it, and runs vercel --global-config <folder> <your args>. When vercel exits, any refreshed token goes back into the keychain, the folder is deleted, and the non-secret CLI settings are kept in ~/.config/vercel-mauth/state/<profile>/.

The token exists on disk only inside that temporary folder (mode 600) while vercel runs, which is how the Vercel CLI itself stores logins.

Claude Code

vercel-mauth install-skill copies skill/SKILL.md to ~/.claude/skills/vercel-mauth/. The skill tells Claude to:

• deploy with vercel-mauth
• check vercel-mauth which before deploying
• never run vercel login
• ask you to run vercel-mauth add for new accounts

Linux note

The keychain backend needs a running Secret Service, which GNOME Keyring or KWallet provides. Headless servers usually do not have one; use vercel --token in CI instead.

License

MIT