Vercel has taken Connect out of public beta, moving the credential system to general availability with more than 100 connectors and a set of governance controls the company says teams asked for in production. The core change: instead of an agent holding a static API token in an environment variable, it requests a credential at the moment it needs one, scoped to that task, and the credential expires on its own.
The stakes are practical rather than theoretical. Every agent that touches Slack, GitHub, Snowflake, or an internal API needs a credential to do it, and for roughly a decade the default has been minting a token that never expires and trusting that nobody copies it. Vercel argues that approach was always the weak point: a vault makes a token harder to steal, but does nothing to limit what a leaked token can do once it is out.
Most teams today manage this problem with secrets vaults, rotation scripts, and shared service-bot credentials that act the same way for every user. That model was built for applications that call a fixed set of APIs on a predictable schedule. Agents break the assumption: they touch more systems, with more autonomy, more often, and each new tool integration is another standing grant that has to be minted, copied across environments, and eventually rotated by hand.
Vercel Connect replaces that grant with a runtime request. According to the company, a deployment’s OIDC identity proves to Connect who is asking, and the SDK’s getToken call returns a token scoped to the specific provider and task, whether that is a single GitHub repository with read-only access or an app-level Slack token. Vercel says identity can also be set per request, so a token acts as the app by default or as a named user when a human has authorized that scope through a one-time consent flow.
Three governance features ship with the GA release, and Vercel says enterprise customers asked for all of them: fine-grained role permissions limiting which staff may set up or edit a connector, a running audit trail of authorization and connector events, and dashboards that break down token and trigger usage project by project. Add the ability to attach credentials per environment and pull them back with a single command, and Vercel argues that answering “who had access to what, and when” stops being an investigation and becomes a lookup.
Vercel’s announcement names several early adopters, including BuildPass, EF World Journeys USA, and Moonpig Group. The company says Moonpig’s internal legal team runs an agent wired into Slack for messages, Jira for tickets, and Google Drive for documents, with Connect handling every credential that agent needs in production. These are customer quotes supplied by Vercel, not independent verification of the security claims, and the company has not published third-party audit results for Connect’s token-issuance path.
Usage sets the price. Hobby accounts include 500 token requests and 1,000 trigger events each month at no charge. Pro pricing charges $3 for every 1,000 token requests, plus a separate $0.95 for every 1,000 trigger events processed, and Enterprise terms are negotiated individually. Vercel says anyone who adopted Connect during the beta keeps today’s terms right up to September 25, 2026, the date the new rate structure begins.
The credential-lifetime problem Connect addresses is not specific to Vercel’s platform. Most production agent stacks today still rely on the same pattern Connect is designed to replace: a shared bot token stored in a secrets manager, granted broad scope up front because narrowing it per task was not worth the engineering effort, and rotated on a schedule rather than expiring automatically. Anthropic’s MCP and OpenAI’s function-calling frameworks both leave credential issuance to the developer, which is why this has become an ecosystem-wide gap rather than a single vendor’s oversight.
Teams running agents in production on any platform, not just Vercel’s, should treat this release as a prompt to audit how their own agent credentials are scoped and how long they live before the next incident forces the question.
Vercel published this announcement on its engineering blog; the piece is a first-party company post with no listed publication date.
