Agent Credential Management

9 posts · Dec 2022 – Aug 2026

What this trail covers

Vercel's platform continues to evolve its security posture for AI agents, focusing on robust defenses against prompt injection and data exfiltration. This includes emphasizing scoped tools, treating model output as untrusted, and providing libraries for sanitizing markdown. The platform also offers guidance on designing for failure, ensuring that even when agents behave incorrectly, the consequences are minimized.

All Vercel trails

Aug 2026The end of credential sprawl for agentsThis post announces the general availability of Vercel Connect, a system that replaces long-lived tokens with short-lived, automatically refreshing tokens requested at runtime. It introduces the `getToken` SDK function, OIDC identities for authentication, and fine-grained scoping for credentials (e.g., per-repository access on GitHub). It highlights over 100 preset connectors, custom connector creation via OAuth/API keys, and governance features like RBAC, audit logs, and token observability. The post also details how Vercel Connect handles event triggers without requiring secrets in the application and its integration with various agent frameworks like eve and the AI SDK.
Aug 2026How v0 authenticates to Snowflake without exposing the user's OAuth tokenThis post details the implementation of a Snowflake request proxy for v0 sandboxes to securely handle user OAuth tokens. The proxy leverages the Vercel Sandbox firewall to intercept requests, verify the sandbox's identity, and mint user-scoped Snowflake credentials server-side. It avoids exposing the user's OAuth token to the generated code by injecting credentials only into specific authentication fields (Authorization header for SQL API, token field for login requests) and rejecting requests where the placeholder token appears outside these fields. This approach maintains compatibility with existing Snowflake clients while preventing credential exfiltration.
Jun 2026The Agent StackThis post introduces the 'Agent Stack' as a collection of building blocks for creating production-grade agents. It details three core capabilities: connecting to models (AI SDK, AI Gateway), executing complex workflows (Workflow SDK, Vercel Sandbox), and connecting to data and tools (Vercel Connect, Chat SDK). It also introduces the 'eve' agent framework. Vercel Connect is highlighted as a system for scoped, short-lived access to data and systems, building upon previous work in credential management.
Jun 2026Introducing Vercel ConnectIntroduced Vercel Connect, a system that replaces long-lived provider tokens with runtime credential exchange. Connectors are registered once and reused across projects/environments with project-level access controls. Agents request short-lived, scoped tokens at runtime using the `@vercel/connect` SDK, proving identity via OIDC. Tokens can be scoped to specific repositories, permissions, and even individual users. Access can be contained by environment, and connectors can be revoked. Event-driven agents are supported via verified webhooks from Slack, GitHub, and Linear, with signing secrets managed server-side by Vercel Connect. Adapters are provided for Better Auth, Auth.js, AI SDK, MCP clients, and the eve agent framework.
Jun 2026Vercel for Enterprise Apps and AgentsThis post introduces Vercel for Enterprise Apps and Agents, a platform designed to enable companies to ship AI applications and agents safely and securely within their access and security boundaries. Key components include Vercel Passport for identity provider integration and default privacy of internal apps/agents, Vercel Connect for providing agents with short-lived, scoped credentials to systems like Slack, GitHub, and Snowflake, and Enterprise Managed Users for full lifecycle control of Vercel users via SAML SSO and Directory Sync. It also highlights the integration of v0 with Snowflake for democratizing data app building and introduces Bring Your Own Cloud (BYOC) on AWS for running workloads within a customer's AWS account. The core technical contribution is the integration of these security and governance features into a unified platform for enterprise AI development and deployment.
Advertisement
Sep 2025Introducing x402-mcp: Open protocol payments for MCP toolsIntroduces the x402 open protocol for programmatic payments in HTTP requests, enabling agents to interact with paid external services without prior account setup or key management. Implements `x402-mcp` to integrate x402 payments with Model Context Protocol (MCP) servers and the Vercel AI SDK. Provides `paymentMiddleware` for protecting API routes and `wrapFetchWithPayment` for client-side consumption. For MCP servers, `createPaidMcpHandler` allows defining `paidTool`s with prices. The protocol works by using the 402 status code for payment instructions, with clients submitting payment authorization in a header. Current implementations settle payments in USDC on the Base blockchain, but the standard is payment-network agnostic. A starter template demonstrates x402 with Next.js, AI SDK, AI Elements, and AI Gateway.
Aug 2025Introducing Vercel MCP: Connect Vercel to your AI toolsIntroduces Vercel MCP (Model Context Provider) server, a secure, OAuth-compliant interface enabling AI clients (like Cursor and Claude) to interact with Vercel projects. This provides AI tools with structured, read-only access to Vercel documentation, deployment logs, and project metadata. The MCP server supports the Model Context Protocol specification for tools and prompts, allowing AI models to call external systems. It emphasizes security through a read-only mode, an allowlist of approved clients, and OAuth consent screens to prevent issues like the Confused Deputy problem. The post also highlights the potential for developers to build their own MCP servers.
Jun 2025Building secure AI agentsThis post details critical security risks for AI agents, specifically prompt injection and data exfiltration. It introduces the concept of assuming total compromise, advocating for tightly scoped tools bound to specific tenants or users. The post highlights that prompt injection is fundamentally a data problem, often originating from indirect inputs like retrieved documents or web scrapes. It provides an LLM equivalent of the 'Little Bobby Tables' SQL injection example. For exfiltration, it warns against rendering model output directly as markdown or HTML, recommending sanitization and providing libraries like `harden-react-markdown` and `markdown-to-markdown-sanitizer`. The core advice is to design for failure, limiting the damage when models behave incorrectly by scoping tools, treating output as untrusted, and avoiding secrets in prompts.
Aug 2024Enhancing security of backend connectivity with OpenID Connect (OIDC)This post introduces Vercel's support for OpenID Connect (OIDC) Federation, enabling developers to replace long-lived credentials with short-lived, RSA-signed JWTs for external requests in Vercel Functions and builds. It details how Vercel acts as an Identity Provider (IdP) to issue verifiable tokens that can be used to authenticate with third-party services like AWS. The post contrasts the security risks of static, long-lived credentials with the benefits of OIDC, such as automated token issuance, rotation, and reduced attack surface. It provides a code example demonstrating how to use the `@vercel/functions/oidc` package to fetch AWS credentials dynamically using a role ARN and a Vercel-provided OIDC token.
May 2024Securing data in your Next.js app with Okta and OpenFGAThis post introduces the concept of a Data Access Layer (DAL) for Next.js applications to centralize authentication and authorization checks. It explains the differences between client-side and server-side code, and server and client components in Next.js. The post then details how to implement fine-grained authorization using OpenFGA (or Okta FGA) for relationship-based access control (ReBAC), providing an example authorization model and demonstrating how to integrate the OpenFGA SDK into the DAL for checking permissions.
Dec 2022Announcing SvelteKit Auth: Bringing NextAuth.js to all frameworksThis post announces the expansion of Auth.js to support SvelteKit, introducing SvelteKit Auth. It details the use of `@auth/core` and the `@auth/sveltekit` package, demonstrating how to configure OAuth providers (e.g., GitHub) using environment variables and implement user sign-in/sign-out functionality within SvelteKit applications. It also shows how to protect routes for authenticated users.