Scan after deploy
Netlify
A deploy notification that starts a scan.
Integration guide
Scan your website after every Vercel deployment
Add a Vercel webhook for successful deployments that points at Rookflare, and each deployment starts a scan of your website. No code to write.
Overview
What the Vercel integration does
What it does
- Vercel posts an event to Rookflare when a deployment of the project finishes; there is nothing to add to your build.
- For projects connected to GitHub, Rookflare reads the commit SHA from the event (payload.deployment.meta.githubCommitSha) and uses it as the ref.
- Rookflare reads only that SHA and ignores the rest of the event.
Before you start
- A Growth and Agency plan. The 14-day free trial runs on Growth, so you can set it up before you pay.
- A verified website in Rookflare with monitoring turned on, and the owner or admin role.
- A Vercel project that deploys your website. Account webhooks are only available on Vercel’s Pro and Enterprise plans, and you need access to the team’s Settings → Webhooks.
Setup
Set up Vercel step by step
-
Step 1
Create the deploy hook in Rookflare
Open the website, go to the Settings tab and select “Create deploy hook” in the “Scan after deploy” card. Copy the token right away: this is the only time Rookflare shows it in full. The card keeps the endpoint and the last four characters of the token.
The Scan after deploy card right after “Create deploy hook”: the full token is shown once, with the endpoint below it. -
Step 2
Copy the webhook URL
Vercel calls a URL and cannot add an Authorization header, so the token goes into the URL as a query parameter. Treat the whole URL as a secret.
https://app.rookflare.example/api/webhooks/deploy?token=YOUR_DEPLOY_TOKENSample endpoint and placeholder token. The dashboard fills in yours.
-
Step 3
Add the webhook in Vercel
In Vercel, choose your team scope and open Settings → Webhooks. Select the “Deployment Succeeded” event, set the project scope to the project that serves your website, paste the URL as the endpoint and select “Create Webhook”. Vercel then shows a signing secret once; Rookflare does not need it, because the token in the URL already identifies the website.
-
Step 4
Redeploy from Vercel
Open the project’s Deployments page in Vercel and redeploy the latest production deployment. When it is ready, “Last used” on the Rookflare card changes and the website’s Scan history shows a scan with the trigger “After deploy”.
The website’s Scan history: the newest scan has the trigger “After deploy” and is scanning; below it a scheduled scan and an earlier deploy scan, both completed.
Troubleshooting
If it does not work
-
There is no Webhooks page in the team settings
Account webhooks come with Vercel’s Pro and Enterprise plans. On another plan, call Rookflare from your CI after “vercel deploy” instead, with the GitHub Actions step or the cURL request.
-
Preview deployments start scans of the live site
“Deployment Succeeded” fires for preview deployments too, and Rookflare does not look at the deployment target. Choose “Deployment Promoted” instead: it fires when a deployment is promoted to production, automatically after a production build or by hand.
-
Each redeploy starts a new scan
Deployments from the Vercel CLI or a deploy hook carry no GitHub commit SHA, so Rookflare has no ref to match. Each call then starts a scan unless one is already running.
-
Calls stopped working after you rotated the token
The old token is baked into the webhook URL. Delete the webhook in Vercel and create it again with the new URL from the Rookflare card.
-
Rookflare answers with an error code
401 means a wrong, rotated or revoked token, 402 a plan or daily limit, 409 an unverified or paused website and 429 more than 30 calls a minute. The cURL guide explains each answer and what to do.
Can I scan only after production deployments?
Yes. Subscribe the webhook to “Deployment Promoted” instead of “Deployment Succeeded”. Promoted fires only when a deployment starts serving production traffic, and it does not include rollbacks.
Is the token safe in a URL?
It is sent over HTTPS and only lets someone start scans of one website. Keep the URL out of public places, and rotate the token on the website’s Settings tab if it leaks; the old one stops working right away.
Our team has several projects. Does one webhook cover them all?
Use one webhook per monitored website. Scope each webhook to the project behind that website and give it the URL with that website’s token, so a deploy of one project never scans another site. Vercel allows up to 20 custom webhooks per team.
Start monitoring your website
Add your address, pick the pages and approve the first scan as your baseline.
Plans start at €19 per month. Prices are provisional.