Vercel Connect

With Vercel Connect, your deployed apps can talk to other services. First, you set up a connection once to Slack, GitHub, Microsoft, Snowflake, Salesforce, or any OAuth or API-key service at the team level. Then, any project you allow can use this connection. Your code asks Connect for access at the moment it needs it, so no provider API key ever lives in your environment variables.

To create your first connector and request a token, follow the Quickstart. For the conceptual model, see the Concepts overview, starting with Connectors, Tokens, and Authentication.

• Call third-party APIs from an agent: Post to Slack, open GitHub PRs, call Microsoft Graph, query Snowflake, or hit any OAuth- or API-key-protected service without bundling provider secrets into your deployment.
• Act on behalf of your users: Ask a user to authorize once, then get a refreshable user token that your agent uses to make calls as that user.
• Receive provider webhooks: Verify and forward signed Slack events to project destinations you control.

To do any of these, you pick a connector for the provider you want to reach:

• Multiple connector types: Browse the available services, connection methods, and capabilities.
• Token subject types: Issue tokens that act as your service (app), a specific user (user), or a federated identity (jwt-bearer) from a single connector.
• Installations and multi-tenancy: Serve many tenants from one connector, such as Slack workspaces, GitHub organizations, or Microsoft tenants.
• Fine-grained scoping: Narrow each token with provider scopes, resource indicators, and rich authorization requests.
• Refresh and revocation: Let tokens refresh automatically, and revoke at the provider when supported.
• Trigger forwarding: Fan out verified webhooks to the project destinations you register on the connector.
• Connector branding: Set a per-connector icon, background color, and accent color.

Read the guide to using Vercel Connect in your project for a broader walkthrough of these capabilities.

When your code calls getToken(), Vercel Connect authenticates in two directions: your code authenticates to Vercel Connect with a Vercel OIDC token or a Vercel access token, and Vercel Connect exchanges the authorized credential with the provider.

The @vercel/connect SDK gives you two ways to authenticate:

• Vercel OIDC token (recommended): On Vercel, the SDK uses the OIDC token that Vercel injects into your deployment automatically. Connect verifies the token and checks it against the connector's project links to confirm your project and environment are allowed to request tokens.
• Access token: For external CI/CD or non-Vercel environments where VERCEL_OIDC_TOKEN isn't available, pass a Vercel access token to the SDK through the vercelToken option on getToken. Dashboard and CLI calls authenticate the same way, using your active Vercel session.

To pull an OIDC token into .env.local for local development, follow the Quickstart.

Each connector type has its own provider-side flow:

• Slack and GitHub: Managed app installs, scoped to one workspace or organization per installation.
• Microsoft: A Microsoft Entra app that Vercel registers in your own Microsoft tenant, installed when a tenant administrator grants it admin consent.
• Custom OAuth: Managed OAuth against the service's URL, on behalf of the installing user (authorization-code flow) or as your service (client-credentials flow).
• API key: A credential the connector owner supplies once at create time.

Each connector defines its provider-side authentication flow. Browse connectors to compare connection methods and setup instructions.

For the full picture, including how token requests are authorized against project links, RBAC for dashboard and CLI calls, the per-connector provider flows, and the error classes thrown on auth failures, see the Authentication concepts page.

Use the @vercel/connect framework adapters to add Connect authentication to AI SDK and MCP clients, eve connections, Chat SDK adapters, Better Auth, and Auth.js.

Every connector includes an Observability tab that logs token requests, authorizations, trigger deliveries, and revocations. Filter events by type, environment, project, or subject, and use stable correlation IDs (tokenId, authorizationId, triggerRequestId) to trace each token across events and match them to your own systems.

To retain events beyond your plan's retention window, forward them to any custom webhook endpoint by adding a Drain (available on Pro and Enterprise plans). See Observability for the full reference.

• SDK Reference: API reference for @vercel/connect, including getToken, getTokenResponse, the ConnectTokenParams and ConnectTokenResponse shapes, and the error classes.
• CLI Reference: Manage connectors, project links, and triggers from the terminal with vercel connect.

You can connect to these providers. Pick the connector that matches the service you want your agent or service to reach:

• Slack: Post messages and receive events through a Vercel-developed Slack app, installed per workspace.
• GitHub: Open PRs and act on repositories through a Vercel-developed GitHub app, installed per organization or user.
• Microsoft: Call Microsoft Graph and Azure APIs through a Microsoft Entra app that Vercel registers in your own Microsoft tenant. You choose its delegated Graph permissions and application permissions at create time, and can change them later. Your code then requests delegated tokens that act as a signed-in user, or app-only tokens that act as the app itself. App-only tokens, and delegated scopes that Microsoft flags as needing an administrator, require a tenant administrator to grant admin consent once.
• Linear: Read and write issues through a Vercel-developed Linear app, installed per workspace.
• Snowflake: Query data through the Snowflake Partner Connect integration.
• Salesforce: Call your Salesforce org through a Vercel-managed OAuth client.
• Custom OAuth: Reach any service that supports OAuth or OIDC at a URL you provide. Bring your own client ID and client secret. Supports both the authorization-code flow with PKCE (to act on behalf of a user) and the client-credentials flow (to act as your service). After creating the connector, open it in the dashboard, click Edit, and select the grant types you want to enable.
• API key: Store a static, long-lived API key for providers that issue one. You supply the key at create time.

The connectors above fall into two operating models, defined in the Vercel Connect product terms. The model determines who registers the OAuth client (or credential) with the Third Party Platform and what setup work falls to you.

• Vercel Managed Connector: Vercel registers the OAuth client with the Third Party Platform, and you authorize Vercel's client to access your account or workspace. You do not register an OAuth client or manage client secrets. Slack, GitHub, Linear, Microsoft, Snowflake, and Salesforce use this model. See Section 3 of the Vercel Connect terms.
• Customer Managed Connector: You register an OAuth client (or generate an API key) with the Third Party Platform yourself and supply the credentials at create time. Vercel stores them and exchanges tokens on your behalf at runtime. You manage those credentials on the provider side. Custom OAuth and API key use this model.

For providers that support it, Vercel Assisted Setup is a one-off helper action that performs some or all of the OAuth-client registration steps on your behalf when you bootstrap a Customer Managed Connector.

Create either kind of connector from the dashboard or with vercel connect create. For a known service, the CLI prompts you for the connection method and any credentials the provider needs, and opens your browser only when the provider requires you to sign in or install an app.

Browse all connectors for the current catalog. Each connector page includes authentication methods, trigger support, and setup instructions.

Vercel Connect is billed per token request. Hobby includes 500 token requests per month at no extra charge. Pro is billed at $3.00 per 1,000 token requests. Enterprise is billed at your negotiated Enterprise rate. Contact your account team for details. See Pricing for the full table and how to stop being billed.

Vercel Connect applies platform limits and per-minute rate limits to SDK methods, CLI commands, and public endpoints. See Limits for the full reference.

Use Vercel Connect when you need delegated runtime credentials, when the same provider serves multiple Vercel projects or environments, or when an agent needs to act on behalf of a user. Use a Vercel Integration instead when you want a marketplace-managed install for a provider-billed product.

Deploy an eve template to start building AI agents that use Vercel Connect to securely access third-party services and APIs: