[Melkeydev]

Adds an optional getAuthHeaders(method, url) to @vercel/sandbox and to createApp in sandbox, so a caller can authenticate each API request with its own headers instead of Authorization: Bearer <token>. The Vercel CLI needs this to run vercel sandbox with a DPoP-bound login (RFC 9449): a DPoP token must be sent with a new proof signed for each request's method and URL, which a token passed through VERCEL_AUTH_TOKEN can't do. Without the option, nothing changes.

@vercel/sandbox

• getAuthHeaders is part of WithFetchOptions, so every static entry point that takes fetch takes it too (Sandbox.list/create/fork/get/getOrCreate, Snapshot.list/tree/get, Drive.list/get/getOrCreate), and instances reuse that client.
• BaseClient wraps fetch with it below withRetry, so every attempt, including 429/5xx retries, gets new headers. When it's set, token isn't sent and isn't treated as an OIDC token to refresh.
• An optional onResponse(url, headers) property gets every response's headers, so a caller can keep a server's DPoP-Nonce. A 401 with use_dpop_nonce and a DPoP-Nonce is sent once more with new headers, unless its body is a stream.
• inferScope and its fetchApi accept it too. The AuthHeadersProvider type is exported.

sandbox

• createApp({ appName, withoutAuth, getAuthHeaders }) uses the provider when no --token or VERCEL_AUTH_TOKEN is given: the token option resolves to "" without looking up OIDC or stored credentials or starting a login, and scope inference and every SDK call use the provider.

Validation

• New auth-headers.test.ts: headers set per request with the method and full URL, onResponse called, one resend on a nonce challenge (at most once, never for a stream body), APIClient sending the provider's headers instead of Bearer with new headers on a 5xx retry, a JWT-shaped token not refreshed, Bearer unchanged without a provider, and fetchApi using the provider.
• New CLI tests: the token option resolves to "" with a provider and doesn't look up a token, VERCEL_AUTH_TOKEN still wins, and sandboxClient sends the provider's headers (with the CLI user agent) only when there's no token. These fail without the change.
• @vercel/sandbox: typecheck passes and unit tests pass, except package-exports.test.ts, which also fails on main without a build. sandbox: typecheck and all 228 tests pass. @vercel/sandbox-mock tests pass.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
sandbox	Ready	Preview, v0	Oct 26, 2026 2:23am UTC
sandbox-cli	Ready	Preview	Oct 26, 2026 2:23am UTC
sandbox-sdk-ai-example	Ready	Preview	Oct 26, 2026 2:23am UTC
workflow-code-runner	Ready	Preview	Oct 26, 2026 2:23am UTC

[vercel]

Supplying getAuthHeaders with teamId and projectId but no token causes SDK entry points to reject with a missing-token error before the provider or fetch runs.