The end of credential sprawl for agents

Every useful agent reaches beyond your codebase. It posts to Slack, opens pull requests, queries Snowflake, or calls an internal API. That reach is what makes it valuable, and it's also where the risk lives, because for years, granting it meant provisioning a long-lived token and hoping it never leaked.

replaces long-lived tokens with ones your code requests at runtime, scoped to the task and expiring on their own.Vercel Connect

During the , we've grown the ecosystem past 100 connectors, unified how they work, and added the governance capabilities teams need in production.public beta

Today, Vercel Connect is generally available.

Managing credentials has become its own workload. Teams write rotation scripts, copy secrets across environments, and share tokens between users. Putting a token in a vault made it harder to steal, but no less dangerous once stolen. It never expires, and no vault limits what a leaked credential can do.

Agents compounded the problem by touching more systems with greater autonomy, more often. Yet the tools to contain a secret haven't changed.

With Vercel Connect, your app never stores credentials. It requests one:

Requesting a token doesn't require another secret. Every deployment on Vercel carries an , and the SDK uses it to prove who's asking.OIDC identity

The difference shows up in the properties of the credential:

Credentials that used to sit in environments long after the work finished now expire on their own. Nothing lingers for an attacker to find.

Scoping happens per request. One step of an agent might read a repository, the next opens an issue, and each asks for only that.

How fine-grained a token can be depends on the service, and GitHub is the clearest example. Requests can restrict a token to a single repository with read-only permissions, rather than trusting a standing grant organization-wide.

The open-source puts this into practice. Choose a preset like , and it mints tokens with only the required scopes.GitHub Tools SDKcode-review

Identity is per request as well. Tokens act as the app by default, but pass a named user as the and the token acts on their behalf, scoped to what they authorized during a one-time consent flow.subject

Vercel Connect now ships with 100+ preset connectors for developer tools and SaaS providers like Notion, Shopify, and Workday, as well as managed connectors for Slack, GitHub, Linear, Salesforce, and more.

Your own services follow the same model via custom OAuth and API Key authentication, and any OAuth-capable MCP server can serve as a connector.

Finding and creating them is faster, too. Browse the on the Vercel website, create a connector in fewer steps, and manage everything from the dashboard, CLI, or API.full catalog

Teams adopting Vercel Connect need more than scoped tokens. They need to control who manages connectors and to track how access is used.

GA adds three capabilities:

Together with per-environment attachment and one-command revocation, access becomes something you can inspect and prove.

When an auditor asks who had access to a system and when, the answer is a query against the audit log, not an investigation across projects and Slack threads.

Vercel Connect is available wherever you and your users are:

Apps and agents built in use the same model.v0

Tell v0 which service your app needs, and it sets up the connector during the build. Slack, GitHub, and other managed connectors need nothing on the provider's side, and since tokens are minted at runtime, the generated app has no secret to keep.

The KERNEL team shipped a this way:voice-driven browser agent

Requesting tokens is half the picture. Your agent also needs to hear about events.

Triggers handle this without putting a secret back in your app. When a user posts in Slack, the provider sends the event to Vercel Connect. It verifies the signature server-side, re-attests the event with an OIDC identity, and forwards it to your project. Forwarded events arrive even with Deployment Protection enabled.

Your app has no bot token to act with and no signing secret to verify webhooks, yet the full loop still runs.

Moonpig Group runs its internal legal agent on this loop in production:

Underneath everything is . Whether your agent is built on eve or the AI SDK, runs as a background job in Vercel Workflows, or is a loop you wrote yourself, it asks for a credential the same way.getToken

Around that call, adapters handle the wiring:

For eve agents and Chat SDK apps, the two secrets a Slack integration usually keeps in your environment, and , are gone from your app entirely.SLACK_BOT_TOKENSLACK_SIGNING_SECRET

Vercel Connect is available on all plans, with pricing based on token requests and trigger events. The Hobby plan includes 500 token requests and 1,000 triggers per month at no additional cost. Pro plans are billed at $3 per 1,000 token requests and $0.95 per 1,000 triggers, with custom pricing on Enterprise.

If you used Vercel Connect during the beta, your current billing terms stay unchanged until September 25, 2026, when the updated pricing takes effect.

Read more