---
title: "Allowing our agent through the Vercel Firewall"
source: "https://ottom.io/docs/cdn/vercel"
summary: "On Vercel, our agent is let through with one custom rule in the project’s Firewall: it matches our addresses and a user agent that starts with our token, with the action Bypass. Bypass passes the request over your custom and managed rules, and is available on every plan."
---

# Allowing our agent through the Vercel Firewall

On Vercel, our agent is let through with one custom rule in the project’s Firewall: it matches our addresses and a user agent that starts with our token, with the action Bypass. Bypass passes the request over your custom and managed rules, and is available on every plan.

## What to match

- User agent starts with `OttomAgent/`. The full string is `OttomAgent/1.0 (+https://ottom.io/agent)`, with `Mobile` added when a check walks your store at phone size.
- Source address is one of those in https://ottom.io/agent/ips.json, also listed at https://ottom.io/agent#addresses.

Match both, never the user agent alone: anyone can send our user agent, but only we send it from those addresses.

## What you need

- Permission to edit the project’s Firewall.
- The current addresses from https://ottom.io/agent/ips.json.

## Setting it up

1. **Add a rule.** Open the project, go to Firewall, open the menu and choose Configure, then Add New, Rule. Name it Allow Ottom agent.
2. **Match our addresses and user agent.** Add the condition IP Address with each address from the file. Add a second condition, joined with and: User Agent, starts with, and the value below.

```
OttomAgent/
```
3. **Set the action to Bypass and publish.** Choose Bypass, then Save Rule, Review Changes and Publish. A rule with Bypass cannot be set in vercel.json, so it has to be made here.

## Checking it works

Run a scan of your store from your Ottom dashboard. When the rule works, the report has no bot protection finding and the agent reaches your products. In the Firewall’s traffic view, our requests show the rule as matched with the action Bypass.

## When a scan is still blocked

### The rule never matches

Check the rule was published, not only saved, and that it lists every address in the file.

## Good to know

- Vercel also has System Bypass Rules, which match an address alone. The custom rule above is the narrower one.
- If your store is a headless front end on Vercel, the cart and checkout may be served by your commerce platform instead. Allow us there as well.

## Vercel documentation

- Vercel WAF custom rules: https://vercel.com/docs/vercel-firewall/vercel-waf/custom-rules
- Firewall concepts: https://vercel.com/docs/vercel-firewall/firewall-concepts

## Questions

### What does Bypass skip?

Vercel documents it as passing the request over any custom or managed rule. It applies only to requests that match both conditions.

The same rule for other providers: https://ottom.io/docs/cdn