fix(cli): Use device code flow for missing scope re-authentication by anatrajkovska · Pull Request #15074 · vercel/vercel

anatrajkovska · 2026-02-17T11:23:55Z

If the user switches to a team using vercel switch which has SSO or MFA enforced and the user hasn't yet authorized the team, instead of redirecting them to the old SSO flow which is deprecated, now we will use the device code flow which supports passing the team_id query param that enforces the user to authorize the request before they can login.

Warning

High Risk Change

This PR changes the authentication flow for team re-authentication, replacing the deprecated SAML/SSO login flow with device code flow, which is a refactor of the auth mechanism that requires careful review to ensure the new flow properly enforces authorization.

Replaces SAML login and prompt-based re-auth with device code flow
Removes user confirmation prompt before SAML login
Always passes teamId for re-authentication (previously conditional on SAML)

^{Risk assessment for commit 794b171.}

changeset-bot · 2026-02-17T11:24:03Z

🦋 Changeset detected

Latest commit: 4a3f5b3

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
vercel	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

github-actions · 2026-02-17T11:24:09Z

📦 CLI Tarball Ready

The Vercel CLI tarball for this PR is now available!

Quick Test

You can test this PR's CLI directly by running:

npx https://zero-config-hirdhvusb-uncurated-tests.vercel.app/tarballs/vercel.tgz --help

Use in vercel.json

To use this CLI version in your project builds, add to your vercel.json:

{
  "build": {
    "env": {
      "VERCEL_CLI_VERSION": "vercel@https://zero-config-hirdhvusb-uncurated-tests.vercel.app/tarballs/vercel.tgz"
    }
  }
}

github-actions · 2026-02-17T11:25:05Z

🧪 Unit Test Strategy

Comparing: fe0c380 → 4a3f5b3 (view diff)

Strategy: Affected packages only

✅ Only testing packages that have been modified or depend on modified packages.

Affected packages - 1 (3%)

vercel

Unaffected packages - 39 (98%)

@vercel-internals/get-package-json
@vercel/backends
@vercel/build-utils
@vercel/cervel
@vercel/cli-auth
@vercel/client
@vercel/config
@vercel/detect-agent
@vercel/edge
@vercel/elysia
@vercel/error-utils
@vercel/express
@vercel/fastify
@vercel/firewall
@vercel/frameworks
@vercel/fs-detectors
@vercel/functions
@vercel/gatsby-plugin-vercel-builder
@vercel/go
@vercel/h3
@vercel/hono
@vercel/hydrogen
@vercel/koa
@vercel/nestjs
@vercel/next
@vercel/node
@vercel/oidc
@vercel/oidc-aws-credentials-provider
@vercel/python
@vercel/python-analysis
@vercel/redwood
@vercel/related-projects
@vercel/remix-builder
@vercel/routing-utils
@vercel/ruby
@vercel/rust
@vercel/static-build
@vercel/static-config
examples

Results

Unit tests: Only affected packages will run unit tests
E2E tests: Running in parallel via E2E Tests workflow
Type checks: Only affected packages will run type checks

This comment is automatically generated based on the affected testing strategy

mehulkar

stamping to get past code owners since Accounts team has already approved

…ope-in-device-code-flow

vercel · 2026-02-23T15:31:36Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
zero-config-go	Ready	Preview, Comment	Feb 23, 2026 3:32pm

This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## vercel@50.23.0 ### Minor Changes - [dev] allow to skip authentication and project linking for `vc dev` by setting `VERCEL_EXPERIMENTAL_DEV_SKIP_LINK` env var. ([#15122](#15122)) - [services] detect project root to prevent accidental setup of a service as a standalone project. ([#15187](#15187)) ### Patch Changes - Fix re-authentication for teams with missing scope to use the device code flow instead of the deprecated SSO redirect flow. ([#15074](#15074)) - Add CLI eval for vc env command ([#15118](#15118)) - Updated dependencies \[]: - @vercel/node@5.6.7 ## @vercel/functions@3.4.3 ### Patch Changes - [functions] Revert "[functions] URL encode cache tags" ([#15213](#15213))  > [!NOTE] > Low Risk Change > > This PR contains only version bumps and changelog updates from the Changesets release automation, with no actual code changes. > > - Deletes changeset markdown files consumed during release > - Updates version numbers in package.json files (50.22.3→50.23.0, 3.4.2→3.4.3) > - Adds changelog entries documenting previously merged changes > > <sup>Risk assessment for [commit 18f0132](https://github.com/vercel/vercel/commit/18f013287efb10cb34e666236f9e34f0c72d0c83).</sup>  Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

This PR is a follow up of #15074 and removes the dead code for the legacy SSO flow, as it is not used anymore.  > [!WARNING] > High Risk Change > > This PR removes legacy SSO/SAML login flow code (oauth.ts, saml.ts, verify.ts, prompt.ts) which is dead code cleanup as stated, but removing authentication-related code paths warrants careful review to ensure the new flow fully replaces this functionality. > > - Deletes entire oauth.ts, saml.ts, verify.ts, and prompt.ts files handling legacy SSO login > - Removes OAuth callback server, SAML login flow, and token verification logic > - Adds CODEOWNERS entries for login/logout/teams paths to identity-and-access-management team > > <sup>Risk assessment for [commit c75fa98](https://github.com/vercel/vercel/commit/c75fa9884892abf45494adec0fbbbd03a0770f17).</sup>

Use device code flow for missing scope re-authentication

b94d3ce

Pass teamId even if SAML is not enabled (MFA case)

794b171

vercel bot deployed to Preview February 17, 2026 14:44 View deployment

anatrajkovska marked this pull request as ready for review February 18, 2026 13:12

anatrajkovska requested review from a team as code owners February 18, 2026 13:12

anatrajkovska requested a review from a team February 18, 2026 13:13

marcgreenstock approved these changes Feb 18, 2026

View reviewed changes

AAorris approved these changes Feb 18, 2026

View reviewed changes

mehulkar approved these changes Feb 18, 2026

View reviewed changes

Merge branch 'main' into ana/iam-5826-update-cli-to-handle-missing-sc…

4a3f5b3

…ope-in-device-code-flow

vercel bot deployed to Preview – zero-config-go February 23, 2026 15:32 View deployment

vercel bot deployed to Preview – vercel February 23, 2026 15:32 View deployment

anatrajkovska enabled auto-merge (squash) February 24, 2026 10:18

vercel bot deployed to Preview February 24, 2026 11:23 View deployment

anatrajkovska merged commit c347fe1 into main Feb 24, 2026
180 checks passed

anatrajkovska deleted the ana/iam-5826-update-cli-to-handle-missing-scope-in-device-code-flow branch February 24, 2026 11:23

vercel-release-bot mentioned this pull request Feb 24, 2026

Version Packages #15225

Merged

anatrajkovska mentioned this pull request Feb 24, 2026

chore(cli): Remove dead code for legacy SSO flow #15228

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(cli): Use device code flow for missing scope re-authentication#15074

fix(cli): Use device code flow for missing scope re-authentication#15074
anatrajkovska merged 3 commits intomainfrom
ana/iam-5826-update-cli-to-handle-missing-scope-in-device-code-flow

anatrajkovska commented Feb 17, 2026 •

edited

Loading

Uh oh!

changeset-bot bot commented Feb 17, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 17, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 17, 2026 •

edited

Loading

Uh oh!

mehulkar left a comment

Uh oh!

vercel bot commented Feb 23, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

anatrajkovska commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot bot commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

github-actions bot commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📦 CLI Tarball Ready

Quick Test

Use in vercel.json

Uh oh!

github-actions bot commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🧪 Unit Test Strategy

Results

Uh oh!

mehulkar left a comment

Choose a reason for hiding this comment

Uh oh!

vercel bot commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

anatrajkovska commented Feb 17, 2026 •

edited

Loading

changeset-bot bot commented Feb 17, 2026 •

edited

Loading

github-actions bot commented Feb 17, 2026 •

edited

Loading

github-actions bot commented Feb 17, 2026 •

edited

Loading

vercel bot commented Feb 23, 2026 •

edited

Loading