The end of credential sprawl for agents

Vercel Connect replaces the traditional pattern of provisioning long-lived API tokens for agents. Instead of storing credentials in environments or vaults, code requests a token at runtime. The token is scoped to the specific task, carries an identity, and expires without manual intervention. This removes the need to rotate secrets or redeploy when a token leaks.

The change shifts the security model from hoping tokens never leak to limiting what a leaked token can do. Scoping happens per request: one step of an agent might read a repository, the next opens an issue, and each token carries only the required permissions. Identity is also per request; tokens can act as the app or as a named user, scoped to what that user authorized during a one-time consent flow.

Adopting the model requires no new secrets. Every Vercel deployment carries an OIDC identity, and the SDK uses it to prove who is requesting a token. The 100+ preset connectors cover common SaaS and developer tools, and custom OAuth or API key connectors extend the model to internal services. Teams can browse, create, and manage connectors from the dashboard, CLI, or API.

General availability adds governance capabilities that scale with team size. Fine-grained RBAC controls who can create and manage connectors. Audit logs record authorization and connector activity, and observability shows token usage across projects. Revocation is a single command, per user or all tokens. The combination lets teams inspect and prove access without cross-project investigations.