# The end of credential sprawl for agents

DevFeed: [The end of credential sprawl for agents](<https://devfeed.tech/articles/the-end-of-credential-sprawl-for-agents-777.md>)

Original publisher: [Read original article](<https://vercel.com/blog/the-end-of-credential-sprawl-for-agents>)

Author: Dima Voytenko

Published: 2026-08-25T04:00:00Z

Content type: article

Language: en

Sources: [Vercel News](<https://devfeed.tech/sources/vercel-news.md>)

Topics: [Vercel](<https://devfeed.tech/topics/vercel.md>), [Security](<https://devfeed.tech/topics/security.md>), [OAuth](<https://devfeed.tech/topics/oauth.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [SDKs](<https://devfeed.tech/topics/sdks.md>), [API](<https://devfeed.tech/topics/api.md>), [pull-requests](<https://devfeed.tech/topics/pull-requests.md>)

Tags: [agents](<https://devfeed.tech/tags/agents.md>), [connectors](<https://devfeed.tech/tags/connectors.md>), [github](<https://devfeed.tech/tags/github.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [pull-requests](<https://devfeed.tech/tags/pull-requests.md>), [sdk](<https://devfeed.tech/tags/sdk.md>), [security](<https://devfeed.tech/tags/security.md>), [shopify](<https://devfeed.tech/tags/shopify.md>)

## AI overview

Vercel Connect is generally available as a way for applications and agents to obtain short-lived, task-scoped credentials at runtime. It supports connectors for services such as Slack, GitHub, Snowflake, Shopify, and OAuth providers, uses deployment OIDC identity for authentication, refreshes tokens automatically, and avoids storing provider secrets in applications.

## Source excerpt

Every useful agent reaches beyond your codebase. It posts to Slack, opens pull requests, queries Snowflake, or calls an internal API. That reach is what makes it valuable, and it's also where the risk lives, because for years, granting it meant provisioning a long-lived token and hoping it never leaked. Vercel Connect replaces long-lived tokens with ones your code requests at runtime, scoped to the task and expiring on their own. During the public beta, we've grown the ecosystem past 100 connectors, unified how they work, and added the governance capabilities teams need in production. Today, Vercel Connect is generally available. Vaults don't fix long-lived tokens Managing credentials has become its own workload. Teams write rotation scripts, copy secrets across environments, and share tokens between users. Putting a token in a vault made it harder to steal, but no less dangerous once stolen. It never expires, and no vault limits what a leaked credential can do. Agents compounded the problem by touching more systems with greater autonomy, more often. Yet the tools to contain a secret haven't changed. With Vercel Connect, your app never stores credentials. It requests one: You register a connector once for a provider like Slack, GitHub, Snowflake, Shopify, or your own OAuth service You attach it to the projects and environments that need it Your code requests a token at runtime, and it refreshes automatically Your app has no provider secret to commit by accident Requesting a token doesn't require another secret. Every deployment on Vercel carries an OIDC identity, and the SDK uses it to prove who's asking. What changes when access becomes a request The difference shows up in the properties of the credential: Property Stored token Vercel Connect Lifetime Never expires Short-lived, refreshed automatically Reach Everything the agent could need Scoped to the task in the request Identity One shared bot for every user App or a specific named user Rotation Mint, update copi