Vercel Connect adds separate restricted Stripe keys for agent tasks

The managed connection creates scoped credentials, retrieves them at runtime and supports rotation without redeploying the application.

Vercel Connect can now create a separate restricted Stripe API key for an agent or task, giving developers another way to connect payment-account operations to applications. The change appears in Vercel's 23 October changelog and adds “Managed API Key” as a Stripe connector option.

When a developer selects the managed method, Vercel creates and stores a key in the Stripe account using the permissions chosen during setup. The existing MCP and bring-your-own-key connection methods continue to be available.

Matching access to a job

The announcement gives two examples: a revenue-reporting agent with read-only access to charges, and an onboarding agent allowed to write customer records.

Those are different jobs even when they operate against the same Stripe account. A reporting process needs to retrieve information, while an onboarding process may need to create an object. Separate restricted keys let developers describe that difference at the credential layer instead of handing both processes the account's broad default secret.

This is useful as applications accumulate agents for operational tasks. A finance report, a support assistant and a customer-setup workflow may share some account context while requiring very different capabilities. Their credentials can now follow those job boundaries through managed connectors.

Setup through the directory or CLI

Developers can create the Stripe connector from Vercel's directory, choose Managed API Key, select permissions and attach it to a project. The CLI can begin the same setup and open the browser to finish it.

The connection is then identified by a connector UID. In the example supplied by Vercel, an application calls getToken from the Connect package at runtime and passes the returned restricted key to the ordinary Stripe client.

That preserves an important separation in the application code. The program asks the connector for the credential it needs rather than embedding a secret in a deployment file. The Stripe SDK remains the interface used for the actual account operation.

Rotation follows the connector

Vercel says developers can rotate the managed key from connector settings without redeploying. The previous key remains valid for up to 24 hours during the transition.

The overlap supports applications that cannot replace every active process at exactly the same instant. A deployment may contain workers or in-flight jobs still using the earlier key, while new requests receive its replacement. The connector becomes the place where the change is managed.

For developers, that can simplify a recurring maintenance task. A credential update no longer has to be coupled to an unrelated application release just to place a new value in the running environment. Teams can still record the rotation and confirm that the relevant jobs continue to complete.

The release is a concrete addition to the infrastructure around agents. It does not give an agent unlimited payment authority or determine what the business wants it to do. It provides a managed way to supply the selected Stripe permissions for a defined application role.

As more agent workflows reach operational services, that distinction becomes practical engineering work. A useful task should receive the access needed to finish, the application should obtain that access through a clear interface, and credential changes should have a predictable transition. Vercel's managed Stripe connector addresses those parts of the integration.

Sources

- [Vercel Connect adds managed Stripe API keys](https://vercel.com/changelog/vercel-connect-adds-managed-stripe-api-keys) — Vercel - [Vercel changelog, 23 October 2026](https://vercel.com/changelog) — Vercel