The End of Credential Sprawl for Agents

Useful AI agents need to interact with various external systems such as Slack, GitHub, and Snowflake, but traditional methods required issuing long-lived tokens, exposing them to leak risks. Even storing credentials in vaults had the limitation that their scope was not restricted in the event of theft.

Vercel Connect provides short-lived tokens requested at runtime to solve these problems. These tokens are scoped to specific tasks and expire automatically. It currently supports over 100 connectors and has reached General Availability (GA) with governance features required for production environments.

Key features include:

• Automatic Renewal: Apps do not store credentials; they request tokens whenever needed.
• Precise Scoping: Permissions can be restricted per request; for example, in GitHub, you can grant read-only access to specific repositories only.
• Identity Verification: Uses OIDC identities from the Vercel deployment environment to prove the identity of the token requester.

This approach significantly reduces security risks by keeping credential lifetimes short and minimizing permissions. Since tokens previously left in the environment expire automatically, attackers have no opportunity to exploit them.