Vercel integration
WebDecoy’s Vercel integration sets up a log drain for the projects you connect. Vercel then sends WebDecoy the requests your site answered, and you change nothing: no package to install, no middleware to add, no redeploy.
It sees what a script tag cannot. Crawlers that never run JavaScript, requests served straight from the cache, and requests that never invoke a function at all.
Monitoring only. WebDecoy never blocks, redirects or challenges a request. When you decide to act, the policy runs at your own edge, under your control.
Install
Section titled “Install”- Install the WebDecoy integration from its Vercel listing. Choose the team, and either all projects or specific ones.
- Vercel sends you back to WebDecoy. If you do not have an account yet, it walks you through creating one and picks the install back up where you left off.
- Choose which WebDecoy site each project is, and press Connect.
That is the whole install. WebDecoy provisions the drain, and the next request your site answers is reported.
What WebDecoy can reach
Section titled “What WebDecoy can reach”Two permissions, and nothing else:
| Permission | Why |
|---|---|
| Projects, read | To list the projects you choose between |
| Project environment variables, read and write | To set its own three variables, and remove them |
| Drains, read and write | To create its own drain and delete it when you disconnect |
It cannot read your source, your deployments, your domains or your logs beyond the drain it created.
The environment variables
Section titled “The environment variables”Connecting also sets three variables on the project, which the @webdecoy/next middleware uses if you run it. They do nothing on their own.
| Variable | What it is |
|---|---|
WEBDECOY_SITE_KEY |
The organization the project’s reports belong to |
WEBDECOY_SCANNER_ID |
The site identity, so reports attribute to the right site |
WEBDECOY_SENSOR_KEY |
A secret proving reports came from a sensor WebDecoy issued. Written as a Vercel sensitive variable, so nobody can read it back, and set on production and preview only |
What is reported, and what is not
Section titled “What is reported, and what is not”Reported: requests whose user agent names a known crawler or tool, requests with no user agent at all, and requests for crawler-only paths such as /robots.txt.
Never reported: ordinary human visitors. A drain carries every request your site answers, including your customers browsing it, and WebDecoy does not store those.
Query strings are dropped before anything is stored. The path is what identifies what was asked for.
Limited coverage to know about
Section titled “Limited coverage to know about”Vercel has a team-wide setting under Settings → Security & Privacy → IP Address Visibility. With it off, drains arrive with the client IP removed. WebDecoy cannot attribute those to an actor, so it counts them and says coverage is limited rather than showing you a quiet site.
Sampling rules on the drain also apply. If you sample at 10%, WebDecoy sees 10%.
What it costs
Section titled “What it costs”Drain delivery is billed by Vercel as part of your plan’s usage. WebDecoy asks for logs only, never traces, analytics, speed insights or audit logs.
Removing it
Section titled “Removing it”Disconnect a project in WebDecoy and it narrows the drain to the projects that remain, and deletes exactly the three variables it created, by the ids Vercel gave them. A variable of the same name you set yourself is left alone.
Disconnect the integration and it deletes the drain, removes the variables, and uninstalls itself from your Vercel account.