{"record":{"id":"543f67eec6eb7dde","repo":"vercel/ai","slug":"vercel-sandbox-authentication-failed-set-vercel-o","errorCode":null,"errorMessage":"Vercel Sandbox authentication failed. Set VERCEL_OIDC_TOKEN, or pass token, teamId, and projectId to createVercelSandbox(), then verify that they can access Vercel Sandbox.","messagePattern":"Vercel Sandbox authentication failed\\. Set VERCEL_OIDC_TOKEN, or pass token, teamId, and projectId to createVercelSandbox\\(\\), then verify that they can access Vercel Sandbox\\.","errorType":"exception","errorClass":"HarnessSandboxAuthenticationError","httpStatus":null,"severity":"critical","filePath":"packages/sandbox-vercel/src/vercel-sandbox.ts","lineNumber":344,"sourceCode":"async function withVercelSandboxAuthenticationError<T>({\n  settings,\n  operation,\n}: {\n  settings: VercelSandboxSettings;\n  operation: () => Promise<T>;\n}): Promise<T> {\n  try {\n    return await operation();\n  } catch (error) {\n    if (\n      !isVercelSandboxAuthenticationFailure({\n        error,\n        hasConfiguredCredentials: hasConfiguredCredentials(settings),\n      })\n    ) {\n      throw error;\n    }\n    throw new HarnessSandboxAuthenticationError({\n      message: VERCEL_SANDBOX_AUTHENTICATION_MESSAGE,\n      sandboxProviderId: VERCEL_PROVIDER_ID,\n      cause: error,\n    });\n  }\n}\n\nfunction hasConfiguredCredentials(settings: VercelSandboxSettings): boolean {\n  if (process.env.VERCEL_OIDC_TOKEN) return true;\n  if ('sandbox' in settings && settings.sandbox != null) return true;\n  const { token, teamId, projectId } = getSandboxLookupParams(settings);\n  return Boolean(token && teamId && projectId);\n}\n\nfunction isVercelSandboxAuthenticationFailure({\n  error,\n  hasConfiguredCredentials,\n}: {","sourceCodeStart":326,"sourceCodeEnd":362,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/sandbox-vercel/src/vercel-sandbox.ts#L326-L362","documentation":"withVercelSandboxAuthenticationError wraps any underlying sandbox/auth error in a HarnessSandboxAuthenticationError when Vercel Sandbox cannot be authenticated. The library requires either an OIDC token from the environment or an explicit token/teamId/projectId configuration to create and access sandboxes. It rethrows the original error only in cases (reported via hasConfiguredCredentials) where misdiagnosing it as an auth failure would be wrong.","triggerScenarios":"Calling createVercelSandbox(), or the sandbox/template/stopResult/createSession/fork APIs, without VERCEL_OIDC_TOKEN set and without passing token, teamId, and projectId; or passing credentials that lack access to Vercel Sandbox.","commonSituations":"Local scripts run outside Vercel deployments where VERCEL_OIDC_TOKEN is never injected; CI jobs missing the OIDC token env var; wrong teamId/projectId; a team or project that has not enabled Vercel Sandbox; expired OIDC tokens.","solutions":["Set VERCEL_OIDC_TOKEN in the environment (e.g. vercel env pull or run inside a Vercel deployment).","Pass explicit credentials to createVercelSandbox(): token, teamId, and projectId.","Verify the token/team/project can access Vercel Sandbox (feature enabled for the team).","Inspect the wrapped `cause` error for the true underlying failure."],"exampleFix":"// before\nconst sandbox = await createVercelSandbox({ template: 'vercel/node:22' });\n// after\nconst sandbox = await createVercelSandbox({\n  template: 'vercel/node:22',\n  token: process.env.VERCEL_TOKEN,\n  teamId: 'team_xxx',\n  projectId: 'prj_xxx',\n});","handlingStrategy":"validation","validationCode":"function canAuthenticateVercelSandbox(cfg) {\n  return Boolean(\n    process.env.VERCEL_OIDC_TOKEN ||\n      (cfg?.token && cfg?.teamId && cfg?.projectId),\n  );\n}","typeGuard":"function isSandboxAuthError(e) {\n  return HarnessSandboxAuthenticationError.isInstance(e);\n}","tryCatchPattern":"try {\n  await createVercelSandbox(opts);\n} catch (error) {\n  if (HarnessSandboxAuthenticationError.isInstance(error)) {\n    throw new Error('Configure VERCEL_OIDC_TOKEN or token/teamId/projectId', { cause: error });\n  }\n  throw error;\n}","preventionTips":["Ensure VERCEL_OIDC_TOKEN is present in the runtime environment before starting.","Store token/teamId/projectId in config and validate at startup.","Verify team/project has Vercel Sandbox enabled.","Always log the wrapped `cause` for diagnosis."],"tags":["authentication","sandbox","vercel","config"],"backgroundTag":"missing-credentials","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}