Vercel custom domains

Scope and credentials

The adapter adds, retrieves, lists, verifies, and removes domains for one Vercel project. It does not deploy applications, edit customer DNS, register domains, or move a domain from another project. Set VERCEL_TOKEN, VERCEL_PROJECT_ID, and optional VERCEL_TEAM_ID. Give the token only the project/team access required for domain management.

import { createDomainClient } from "@opencoredev/domain-sdk";
import { vercel } from "@opencoredev/domain-sdk/vercel";

export const domains = createDomainClient({
  provider: vercel({
    token: process.env.VERCEL_TOKEN!,
    projectId: process.env.VERCEL_PROJECT_ID!,
    teamId: process.env.VERCEL_TEAM_ID,
  }),
});
const domain = await domains.add("app.customer.com");

DNS, verification, and certificates

Routing records come from Vercel's domain-configuration recommendations; ownership challenges become ownership records. verify() calls the project-domain verification endpoint. The adapter reports active configuration without inventing certificate issuer or expiration metadata unavailable from the project-domain API.

Errors and limitations

Expired tokens map to AUTHENTICATION_FAILED; inaccessible resources map to PERMISSION_DENIED; another project/account maps to DOMAIN_CONFLICT; rate limits preserve retryAfter. Duplicate adds return current state only when projectId matches. Wildcard hostnames such as *.customer.com are attached like any other domain, but A/CNAME routing alone is insufficient for wildcard TLS.

Vercel's SSL documentation requires DNS-01 validation for wildcard certificates, normally using Vercel nameservers. For eligible delegated subdomains, the third-party DNS guide describes enabling Vercel DNS, delegating _acme-challenge with NS records, and configuring wildcard routing. Follow its applicability limits: it warns against this method for apex-level wildcards such as *.example.com and notes potential interference with other providers' certificate issuance. The adapter does not configure this delegation; certificate validation is separate from project ownership verification.

configuredBy: A/CNAME indicates routing, not successful certificate validation. acceptedChallenges lists available certificate challenge types (dns-01 / http-01), not DNS records or tokens. misconfigured covers both domain configuration and automatic TLS certificate generation; an empty challenge list is not solely a different-project signal.

Official references: project domains, verification, and domain configuration.

Read next: Troubleshoot pending DNS.