A valid vercel.json from simple inputs
vercel.json controls how Vercel routes requests, sets headers, pins function regions, and runs scheduled jobs. The schema mixes arrays of objects with specific keys, and a single typo can be silently ignored. This builder assembles a clean, valid configuration so each feature is wired correctly.
How it works
The output is a JSON object whose keys map directly to Vercel features. rewrites and redirects are arrays of objects with source and destination; redirects also carry a permanent flag controlling 308 versus 307. headers is an array pairing a source glob with a list of header name and value objects. crons is an array of path and schedule pairs using standard cron syntax. functions region pinning is expressed through the regions array, and framework overrides auto-detection. Empty sections are omitted so the file stays minimal.
What each section does
rewrites: Proxy requests from one path to another without changing the URL the browser sees. Useful for routing /api/(.*) to a backend service, or serving a third-party app under a subpath. The rewrite is invisible to the end user — the original URL stays in the address bar.
redirects: Send browsers and crawlers to a different URL with a status code. permanent: true emits a 308 (permanent redirect), which search engines cache and pass link equity through. permanent: false emits a 307 (temporary redirect), which search engines re-check on each crawl. Use permanent for moved pages and temporary for maintenance pages.
headers: Add or override response headers on matched routes. Common uses include adding security headers (X-Frame-Options, Content-Security-Policy, Strict-Transport-Security) to every page, or setting Cache-Control on static assets to control CDN caching behavior. The source field accepts glob patterns, so /(.*)\\.js matches all JavaScript files.
crons: Schedule serverless functions to run on a cron expression. Each entry needs a path (the function route to invoke) and a schedule (a standard 5-field cron expression in UTC). For example, 0 3 * * * runs at 03:00 UTC daily. Vercel sends a GET request to the path at the scheduled time; the function must respond within the function timeout.
regions: Pin function execution to one or more Vercel regions to minimize round-trip latency to your database or upstream API. iad1 is US East (Virginia), sfo1 is US West, lhr1 is London, cdg1 is Paris. Choose the region closest to your primary database.
framework: Overrides Vercel’s automatic framework detection. Leave this unset in most cases — Vercel correctly detects Next.js, SvelteKit, Astro, and other frameworks automatically. Set it only when you need to force a specific preset or when using a custom build configuration that the detector misidentifies.
Worked configuration example
For a Next.js app that proxies /api/backend/(.*) to an upstream service, redirects /old-blog to /blog, adds security headers site-wide, and runs a cleanup job nightly:
{
"rewrites": [
{ "source": "/api/backend/(.*)", "destination": "https://api.example.com/$1" }
],
"redirects": [
{ "source": "/old-blog", "destination": "/blog", "permanent": true }
],
"headers": [
{
"source": "/(.*)",
"headers": [
{ "key": "X-Frame-Options", "value": "DENY" },
{ "key": "X-Content-Type-Options", "value": "nosniff" }
]
}
],
"crons": [
{ "path": "/api/cleanup", "schedule": "0 2 * * *" }
]
}Place this file at the project root and commit it. Vercel reads it on each deploy, and the settings take effect immediately on the next deployment.