Vercel Connect adds managed Stripe API keys for agents

Vercel Connect now offers Managed API Key as a connection method when creating a Stripe connector. Vercel creates a separate restricted Stripe key for each agent or task in the connected Stripe account, limited to the permissions selected. The existing MCP and bring-your-own key methods are unchanged.

Vercel notes that many apps and agents use Stripe's default secret key, which has full access to the account. Per-agent keys can narrow that access, such as a revenue report agent limited to reading charges or an onboarding agent limited to writing customers. Vercel stores the key, so no secret has to be pasted, and keys can be rotated from the connector's settings without a redeploy.

When a key is rotated, the old one stays valid for up to 24 hours during the switch. Setup can be done from the connectors directory or the Vercel CLI, using vercel connect create stripe with the managed-api-key connection method, then vercel connect attach to link the connector to a project. At runtime, getToken with the connector's UID returns the restricted key.

Agents that only need reads or specific writes no longer have to run on the full-access default key. Developers can set permissions per agent instead of sharing one broad credential across tasks.

When rotating keys, plan for the old key remaining valid for up to 24 hours.