Vercel CLI 5.14.5 Adds Signed Blob URLs: Secure Storage Without the SDK

Vercel Simplifies Secure Object Access with CLI-Generated Signed Blob URLs

Vercel has quietly shipped a new feature that lets developers generate signed URLs for Vercel Blob directly from the command line, eliminating the need to reach for SDKs or custom API endpoints for basic secure object access. According to the Vercel changelog, updating the Vercel CLI to version 5.14.5 unlocks the vercel blob presign command, which produces scoped URLs with granular permissions and time-to-live settings.

Each signed URL is restricted to a single operation — get, head, put, or delete — a specific pathname, and an expiration window of up to seven days. This granularity means developers can issue time-bombed read-only links to users or grant temporary upload capabilities to third-party services without exposing broader storage access.

What Changed: From SDK to Shell

Previously, generating signed URLs for Vercel Blob required either using the JavaScript SDK (@vercel/blob) or manually crafting signed requests against the Vercel Blob API. The new CLI command collapses that workflow into a single terminal invocation:

vercel blob presign --path /uploads/2026/report.pdf --operation get --expires 3600

This command outputs a fully formed URL that, by default, expires in one hour (customizable up to 7 days). The change is deceptively simple but has meaningful implications for how teams manage object-level security in pipeline automation, CI/CD scripts, and internal tooling.

Why This Matters for AI Developers

For teams building AI pipelines that handle sensitive data — training sets, model weights, or inference results — Vercel Blob signed URLs offer a lightweight alternative to building custom authentication layers around object storage. Consider these common workflows:

• Model artifact distribution: Generate read-only URLs with strict expiry for distributing model packages to inference servers, preventing long-term leak exposure.
• Dataset provisioning: Use put signed URLs to allow data engineers (or external partners) to upload new datasets directly to a specified blob path, without giving them access to other blobs or the ability to delete existing data.
• CI/CD deployment secrets: Generate one-time-use delete URLs as part of cleanup scripts after a deployment pipeline runs, reducing residual data in storage.

Because the URLs are scoped by operation and path, an AI architect can issue a single command like vercel blob presign --path /models/llama-7b/checkpoint.pt --operation get --expires 86400 and safely embed the resulting URL in a cloud-init script for a GPU instance, knowing that even if the environment is compromised, the attacker cannot list, modify, or delete adjacent blobs.

Technical Considerations and Limits

The maximum expiry of 7 days is both a feature and a constraint. It encourages short-lived access patterns, aligning with security best practices for temporary credentials. However, teams requiring longer-term access for archival or batch processing will still need to integrate the SDK into their application logic to regenerate tokens on the fly.

Additionally, the CLI command currently only accepts a single pathname per invocation. If a workflow needs to issue signed URLs for hundreds of objects — for example, when distributing an entire dataset — developers will need to script a loop over the CLI, which adds latency compared to a bulk API endpoint. Vercel has not indicated whether batch generation is on the roadmap.

What This Means for Business Teams

From a security and compliance perspective, signed blob URLs reduce the surface area for unauthorized data access. For businesses subject to SOC 2, HIPAA, or GDPR, the ability to prove that object-level access is time-bound and operation-scoped can simplify audit narratives. Vercel’s CLI integration also means that operations teams can automate these patterns without granting each user direct cloud console access — a single CLI command issued from a CI/CD runner can replace manual, error-prone IAM policy management.

Cost implications are also notable. By issuing ephemeral, scoped links, businesses can reduce the need for dedicated proxy servers that authenticate and redirect to blob storage. Each signed URL effectively functions as a self-contained access token, reducing the load on application middleware.

Competitive Context and Ecosystem Fit

Vercel Blob signed URLs now mirror capabilities found in AWS S3 presigned URLs, Google Cloud Storage signed URLs, and Azure Blob Storage shared access signatures — but with a narrower scope and tighter integration into the Vercel CLI and Edge Network. For teams already on the Vercel platform, this feature closes a gap in serverless storage security. Developers no longer need to maintain a separate Lambda or Edge Function just to sign blob URLs; the CLI handles it in seconds.

The broader trend is clear: Vercel is pushing its storage layer to be as composable and scriptable as its compute layer. By making signed URL generation a first-class CLI verb, Vercel signals that secure object access is no longer an afterthought hooked up via SDK, but a core operation that should be attainable from any shell environment.

Getting Started

To use the new feature, developers need Vercel CLI version 5.14.5 or later. Update with npm i -g vercel@latest or brew upgrade vercel-cli. For full documentation, including examples of each operation and expire combinations, refer to the Vercel Blob signed URLs reference.

As serverless architectures shift toward composable, security-first primitives, the ability to sign blob URLs from the command line could become as routine as checking in code. For AI teams handling model distribution or dataset management, this update is a small but welcome step toward operationalizing secure object storage.”

Source: Vercel Blog. This article was produced with AI assistance and reviewed for accuracy. Editorial standards.