# Every Vercel preview deployment fails with Unauthorized origin, do I add each URL?

Asked by Sasha Litvin on 2025-06-11. Tags: nextjs, vercel, preview, errors.

We run Next.js on Vercel with @croct/plug-next and PR preview deployments
enabled.

Expected: Croct requests succeed on preview deployments like they do on
production and localhost.

Actual: every preview deployment fails Croct requests with "Unauthorized origin".
Each PR gets a fresh random `*.vercel.app` URL, and none of them are recognized.
Production domain and localhost both work fine.

Surely the answer is not adding every generated preview URL to the dashboard by
hand? What is the recommended setup here

## 1 answer

### Accepted answer from cole_b (2025-06-11)

Your diagnosis is right. "Unauthorized origin" means the requesting domain is
not in the application's trusted origins list, and random per-deploy preview
URLs will never be listed because they did not exist when you configured
anything.

The practical fix: use a stable preview alias. Vercel lets you assign a fixed
alias domain to a branch (for example `staging.yourapp.com` or a fixed
`yourteam-staging.vercel.app`), so point reviewers at that alias instead of the
per-commit URL, and add that one domain to trusted origins in the Croct
dashboard. One entry, done.

Side benefit you will care about later: trusted origins also gate experience
preview links from the dashboard. If marketers generate a preview link and open
it on an untrusted domain, it fails the same way. A stable alias fixes both
problems at once.

Related thread with the staging-domain variant of this:
[Unauthorized origin on our staging domain](/answers/unauthorized-origin-staging-domain).

#### Reply from Sasha Litvin (2025-06-12)

Confirmed working. Assigned a branch alias, added it to trusted origins,
preview reviews now behave identically to production. Thanks.