Vercel Connect adds Enterprise-Managed Authorization in public beta

How the access model works

Vercel describes three parts to how access works under EMA. The first is administrator control: admins can grant or revoke access to supported services through the identity provider, rather than relying on each user to approve every connection.

The second is corporate sign-in. Users sign into an app with their corporate account through a compatible identity provider, and Vercel names Okta as an example. The third is scoped tokens. The app requests the scopes it needs, and Connect handles token exchange, caching and renewal.

Vercel states that access is limited to approved scopes and to the user's existing service permissions. In practice, this means an app or agent acting for a user does not gain more reach than the user already has.

Example with Slack and Vercel Passport

The changelog shows how this looks in code for apps that use Vercel Passport. A developer can request a token for Slack's Model Context Protocol (MCP) server using the signed-in user's identity. The sample defines a getResourceToken function that calls requireIdentity from @vercel/passport and then passes that identity, along with the requested scopes, to getToken from @vercel/connect.

Vercel also shows a settings view for EMA on a Slack connector, indicating that the feature is enabled per connector.

Cross-App Access and setup

Vercel says Connect supports Cross-App Access (XAA), including its use for MCP authorization through EMA. To get started, teams are directed to the Vercel Connect EMA setup guide, which covers configuring the identity provider and services and enabling EMA on their Connect connectors.

What it means for teams

For organizations building apps and agents that reach into other services, the main change is who controls the connection. Instead of each user clicking through consent prompts service by service, administrators manage access centrally in the identity provider. Developers, in turn, delegate token exchange, caching and renewal to Connect.

The feature is in public beta, so teams evaluating it should expect it to be an early release. The source does not give pricing or a general availability date.