Vercel Config Generator
Build a complete, valid vercel.json visually — framework preset and build/output/install commands, redirects and rewrites, custom header rules with a one-click security-headers quick-add (HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy), scheduled cron jobs, and deployment regions. The JSON renders live as you edit, and a built-in audit flags conflicting redirect/rewrite sources, paths missing a leading slash, suspect cron schedules, and missing security headers.
About this ToolHow it works, benefits & use casesTap to collapse
A vercel.json file at your repository root controls how Vercel builds and routes a project, and getting every key and shape right by hand is fiddly. This is a real vercel.json builder: pick a framework preset and set the build, output, install, and dev commands, then add as many redirects (source to destination with a 301 Permanent or 307 Temporary toggle), rewrites (proxy a path to a destination without changing the URL), and header rules as you need. Each header rule takes a path pattern plus key/value rows, and a one-click security quick-add drops in HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy. Schedule Serverless Function cron jobs, pin deployment regions, and toggle clean URLs or a trailing slash. The valid, pretty-printed vercel.json regenerates live and only includes the fields you actually set, while a built-in audit flags the mistakes people ship: a source with both a redirect and a rewrite, a path missing its leading slash, a suspect cron schedule, or no security headers.
How to Use
- 1Start from a preset (Next.js, Vite SPA, Static site, API proxy, or Cron jobs) or build from scratch.
- 2Choose a framework preset and set the build command, output directory, install command, and dev command.
- 3Add redirects (with a 301 Permanent or 307 Temporary toggle) and rewrites that proxy a source pattern to a destination.
- 4Add header rules with a path pattern and key/value rows, or click "Add security headers" to drop in the recommended set.
- 5Schedule cron jobs by path and cron expression, pick regions, and toggle clean URLs or trailing slash.
- 6Watch the vercel.json render live, read the audit for problems, then copy or download it into your repository root.
Key Benefits
- A true builder covering redirects, rewrites, headers, crons, and regions, not just build commands
- One-click security-headers quick-add: HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy
- Five presets (Next.js, Vite SPA, Static site, API proxy, Cron jobs) that prefill sensible defaults
- Per-redirect choice between 301 Permanent and 307 Temporary status
- An audit that flags redirect/rewrite source conflicts, missing leading slashes, bad cron schedules, and missing security headers
- Live, pretty-printed JSON that includes only the fields you set and a $schema reference for editor autocomplete
- Shareable URL that captures the entire config for handoff, and everything runs in the browser
Common Use Cases
- Bootstrapping a vercel.json for a new Next.js, Vite, or static deployment
- Adding SPA fallback routing so client-side routes resolve to index.html
- Hardening a site with the standard security headers in one click
- Proxying /api requests to an external backend with a rewrite and CORS headers
- Scheduling Serverless Function cron jobs and pinning functions to specific regions
1 rule · commit to repo root
{
"$schema": "https://openapi.vercel.sh/vercel.json",
"framework": "nextjs",
"buildCommand": "next build",
"installCommand": "npm install",
"devCommand": "next dev",
"headers": [
{
"source": "/(.*)",
"headers": [
{
"key": "Strict-Transport-Security",
"value": "max-age=63072000; includeSubDomains; preload"
},
{
"key": "X-Content-Type-Options",
"value": "nosniff"
},
{
"key": "X-Frame-Options",
"value": "SAMEORIGIN"
},
{
"key": "Referrer-Policy",
"value": "strict-origin-when-cross-origin"
},
{
"key": "Permissions-Policy",
"value": "camera=(), microphone=(), geolocation=()"
}
]
}
]
}
Start from a preset
Build & framework
Vercel infers most settings from the framework; override commands below if needed.
Drop the .html extension from paths.
Force a trailing slash on URLs.
Redirects
No redirects. Send old paths to new ones with a 301/307 status.
Rewrites
No rewrites. Proxy a path to another destination without changing the URL.
Headers
Cron jobs
No cron jobs. Schedule a Serverless Function path with a cron expression.
Regions
Pin Serverless / Edge Functions to specific regions. Leave empty to use Vercel's default.
A real vercel.json builder
A vercel.json at your repository root controls how Vercel builds and routes a project. This tool models the whole file — framework, commands, redirects, rewrites, headers, cron jobs and regions — and emits valid, minimal JSON live, so you compose exactly the config you want without hand-editing keys. vercel.json is still fully supported; Vercel has also introduced a typed vercel.ts option, but this tool outputs the JSON form that works everywhere.
What the audit catches
- The same source having both a redirect and a rewrite — the redirect wins and the rewrite never runs.
- A path that is missing its leading
/. - A cron
schedulethat is not a valid 5-field expression. - No security headers set — use the one-click quick-add.
Was this tool helpful?
Share Your Experience
Help others discover this tool!
Related tools
- JSON FormatterFormat and validate JSON with syntax highlighting
- Redirect Rule GeneratorGenerate redirect rules for various servers and platforms
- Tailwind Config GeneratorVisually build a Tailwind config - theme extend, colors, spacing, fonts, screens, plugins - and export it as a v3 JS config or a v4 @theme CSS block
- Changelog GeneratorGenerate changelog from Git commit history
- Component Name GeneratorTurn a description into ranked, kind-aware component names with a file scaffold and a name validator (casing, collisions, clarity)
- Markdown TOC GeneratorGenerate table of contents for Markdown
A redirect sends the browser to a new URL with a 301 or 307 status, so the address bar changes. A rewrite proxies the request internally: the source pattern is served the destination content while the URL the visitor sees stays the same, which is how the tool wires up API proxying and SPA fallbacks. The audit warns if the same source has both, because the redirect wins and the rewrite would never run.
It adds the widely recommended response headers in one click: Strict-Transport-Security (HSTS) to force HTTPS, X-Content-Type-Options: nosniff to stop MIME sniffing, X-Frame-Options: SAMEORIGIN to block clickjacking, a strict Referrer-Policy, and a Permissions-Policy that disables camera, microphone, and geolocation by default. It only adds headers you do not already have, so it is safe to click on an existing rule.

