Vercel Connect hits GA: secretless runtime tokens for AI agents
Swap stored provider secrets for short-lived, scoped tokens, wire up 100+ services with one CLI command, and let agents auth to MCP and GitHub — free on Hobby.
Copy markdown
Secrets out, short-lived tokens in
Deployments now call getToken() at runtime for scoped, auto-expiring credentials tied to your Vercel OIDC identity, so long-lived provider keys stop living in your env vars. Register 100+ services — GitHub, databases, SaaS APIs — with a single CLI command.
Least-privilege auth for your agents
AI agents can authenticate to MCP servers and GitHub with minimal, role-specific permissions scoped to each task, and plug straight into the AI SDK, MCP clients, Better Auth, and Auth.js. You can ship an agent that reaches private services without ever holding a static secret.
GA brings the guardrails
The GA release adds fine-grained RBAC for connectors, audit logs of every authorization, token and trigger observability across projects, per-environment attachment, and one-command revocation to cut off access instantly.
Free to start, metered to scale
It's on every plan: Hobby includes 500 token requests and 1,000 triggers a month at no cost; Pro runs $3 per 1,000 token requests and $0.95 per 1,000 triggers. Provider webhooks arrive as triggers, with no stored webhook secrets.
Elsewhere: OpenAI ships an Admin plugin for Codex
OpenAI added an Admin plugin for ChatGPT Work and Codex so admins can manage members, roles, and workspace settings from inside chat — worth a look if your team runs Codex and you own the seats.