Every Vercel preview deployment fails with Unauthorized origin, do I add each URL?
We run Next.js on Vercel with @croct/plug-next and PR preview deployments enabled.
Expected: Croct requests succeed on preview deployments like they do on production and localhost.
Actual: every preview deployment fails Croct requests with "Unauthorized origin". Each PR gets a fresh random *.vercel.app URL, and none of them are recognized. Production domain and localhost both work fine.
Surely the answer is not adding every generated preview URL to the dashboard by hand? What is the recommended setup here
1 answer
Your diagnosis is right. "Unauthorized origin" means the requesting domain is not in the application's trusted origins list, and random per-deploy preview URLs will never be listed because they did not exist when you configured anything.
The practical fix: use a stable preview alias. Vercel lets you assign a fixed alias domain to a branch (for example staging.yourapp.com or a fixed yourteam-staging.vercel.app), so point reviewers at that alias instead of the per-commit URL, and add that one domain to trusted origins in the Croct dashboard. One entry, done.
Side benefit you will care about later: trusted origins also gate experience preview links from the dashboard. If marketers generate a preview link and open it on an untrusted domain, it fails the same way. A stable alias fixes both problems at once.
Related thread with the staging-domain variant of this: Unauthorized origin on our staging domain.
Confirmed working. Assigned a branch alias, added it to trusted origins, preview reviews now behave identically to production. Thanks.