Skip to main content
Prerequisite: A Vercel protection bypass secret.
Two methods: headers (fast, but blocked by CORS on some apps) or query parameters (work even when CORS blocks headers).

​
Option A: Headers

In the test’s Network options, add:
These headers are sent with every request in the session, including third-party script requests. If you see CORS errors, use query parameters instead.

​
Option B: Query parameters

Override the base URL in the test’s General options:
Vercel sets the bypass as a cookie for the rest of the session, so subsequent requests don’t need the query string.