Vercel integration
A connectable-account OAuth installation plus fail-closed enforcement for consequential writes — as Edge Middleware or per-route withPresence wrappers.
Install the package
terminal
npm install @decionis/presence-vercelGate configured paths with middleware
middleware.ts
import { createPresenceMiddleware } from "@decionis/presence-vercel"; export const middleware = createPresenceMiddleware({ apiHost: "https://presence.decionis.com", apiSecret: process.env.PRESENCE_API_SECRET!, tenantId: process.env.PRESENCE_TENANT_ID!, protectedRoutes: "/api/checkout/*,/api/transfers",}); export const config = { matcher: ["/api/:path*"] };Or wrap a single route handler
app/api/transfers/route.ts
import { withPresence } from "@decionis/presence-vercel"; export const POST = withPresence(async (req) => { return Response.json({ ok: true });});Integration lifecycle endpoints
vercel-installation.txt
Redirect URL https://presence.decionis.com/v1/connectors/vercel/callbackWebhook URL https://presence.decionis.com/v1/connectors/vercel/webhooksConfiguration https://presence.decionis.com/dashboard/connectorsRemoval event integration-configuration.removedChoose middleware or route handlers
- 01
Presence adds execution-time human verification to sensitive Next.js routes. It gates configured POST, PUT, and DELETE requests before they reach your application, validates Presence sessions and ES256 proofs locally at the edge, and returns explicit 403 or 503 outcomes when verification is denied or unavailable.
- 02
Pick the execution mode that fits each project: createPresenceMiddleware gates matched paths from middleware.ts with no application changes, and withPresence wraps an individual route handler where the choice belongs in code. Both run the identical fail-closed gate, and valid local proofs continue without an API round-trip.
- 03
Vercel redirects an installation to Presence with a one-time authorization code. Presence exchanges it server-side, encrypts the access token, and hands the browser only a random, single-use installation reference before the owner selects a Presence workspace.
Verify the implementation
OAuth codes and access tokens stay server-side; the browser receives a short-lived, one-use handoff bound to one Vercel configuration.
Installation handoff →Removal webhooks are verified against the exact request bytes before the encrypted installation is disabled and redacted.
Webhook verification →
Current limits
- Only POST, PUT, and DELETE requests are gated. A matched or wrapped GET handler passes through without verification.
- The Presence API secret is a server-side Vercel environment variable. Never prefix it with NEXT_PUBLIC_ or send it to browser code.
- A connectable-account installation links Vercel and Presence accounts; it does not provision a native Vercel Marketplace resource or billing plan.
- The initial listing requests no Vercel REST API scopes; project access and environment configuration remain customer-controlled.
One next step
Continue with the executable path.