Keep tokens out of argv

Export VERCEL_TOKEN; a --token flag lands in shell history.

From vercel-cli-with-tokens, SKILL.md “Working Agreement”.

Where the token ends up

Press Deploy, then read history and ps.

Token as a flagBad
vercel deploy --token vca_…
Token in the envGood
export VERCEL_TOKENthenvercel deploy
# Look before asking the user: the env, then .env
printenv VERCEL_TOKEN
export VERCEL_TOKEN=$(grep '^VERCEL_TOKEN=' .env | cut -d= -f2-)

# The CLI reads VERCEL_TOKEN itself. No --token flag.
vercel deploy -y --no-wait

Why it matters, pros and cons

Why it matters

Arguments are saved to shell history and shown to anyone who can list processes. The CLI reads the environment silently.

Pros

  • The token never reaches history or ps.
  • Every later command picks it up.
  • Same flow in CI with a secret variable.

Cons

  • Every child process inherits it.
  • The .env holding it must stay out of git.