Khoury College of Computer Sciences
CS 4550 / CS 5610 · Web Development · Fall 2026
Vercel Connect GA: short-lived tokens instead of credential sprawl
- AI
- Security
- Course
Instructor-curated digest, not original reporting. Each post paraphrases a public article and links to the original source.
On August 25, 2026, Hedi Zandi, Ben Sabic, and Dima Voytenko announced that Vercel Connect is generally available. Connect replaces long-lived provider tokens with short-lived ones your code requests at runtime, scoped to the task. During the public beta the ecosystem grew past 100 connectors.
Apps register a connector once, attach it to projects, and call getToken at runtime; deployments use OIDC identity so there is no provider secret to commit. GA adds fine-grained RBAC for who manages connectors, audit logs, and token and trigger observability. Triggers forward provider events with server-side signature verification so webhook signing secrets stay out of the app. Hobby includes 500 token requests and 1,000 triggers per month; Pro is billed at $3 per 1,000 token requests and $0.95 per 1,000 triggers, with beta billing terms unchanged until September 25, 2026.
Keeping secrets out of the app fits the Node server work in Chapter 5 and the same Vercel deploy path as Chapter 1.
Read original: The end of credential sprawl for agents — Vercel