Most people grant a token picturing "it reads my deploy status". Here is the actual list.
What it can read#
| Notes | |
|---|---|
| Projects and settings | Names, framework, build config, git connection |
| Deployments | Status, commit, author, branch, URLs |
| Build and runtime logs | Which can themselves leak secrets if you log them |
| Usage and billing data | Since the February 2026 billing API |
| Domains and DNS | Including configuration |
| Environment variables | Including decrypted values |
| Team membership | Who is on the team |
That last-but-one row is the one that matters. The API supports retrieving environment variables with values decrypted. If your production database URL is in there, a token that can read env vars can read your production database URL.
What it can change#
- Create and trigger deployments
- Delete deployments
- Promote a deployment to production (rollback)
- Pause and unpause projects
- Create, update and delete environment variables
- Modify domains
- Depending on scope, delete projects
A Vercel token is closer to an account password than to a read-only API key.
Why it is not more granular#
Vercel's token scoping is coarser than most people expect. You can scope by team. You cannot easily mint a token that reads deployment status but cannot touch projects — the granularity to express "status only" mostly is not there.
That is a platform limitation, not something an app can work around, and it means every app in this category holds more power than it needs. Including ours.
More detail: Vercel API token scopes, explained.
Reducing the exposure#
- A dedicated token per app. Revoke one without breaking the others.
- Scope to one team where you can.
- Keep real secrets out of env vars where possible — a secrets manager referenced at runtime beats a plaintext value sitting in project config.
- Mark sensitive variables as such in Vercel, which restricts reading them back.
- Audit and revoke periodically. Tokens outlive the apps they were made for.
- Rotate after any vendor incident. In April 2026 Vercel disclosed a supply-chain compromise via a third-party OAuth application in which customer environment variables were exposed. Third-party access is the attack path.
MONII requires Face ID before displaying an environment variable value, and re-locks after 30 seconds.
Be clear about what that protects against: someone holding your unlocked phone. It does not restrict what the token can do — the API can read those values regardless of what the UI puts in front of them. Any app telling you biometrics limit an API's capabilities is confusing a display control with an access control.
Questions people actually ask
Can a Vercel token read environment variable values, not just names?
Yes. The API supports retrieving decrypted values. Any app with a suitably scoped token can read your secrets, regardless of what its UI shows.
Can a Vercel token delete things?
Yes — deployments and, depending on scope, projects. Tokens are not read-only by default.
Face ID before secrets
MONII gates environment variable reveal behind Face ID and auto-relocks after 30 seconds. The token could read them anyway — the gate is about shoulder-surfing, not the API.
Get MONII for iOS ›