Vercel Connect adds managed Stripe API keys for each agent or task

Narrower access than the default secret key

According to Vercel, most apps and agents run on Stripe's default secret key, which has full access to the account. The new option is meant to change that by giving each agent only the access its job requires.

Vercel gives two examples. A daily revenue report agent can be limited to read-only access to charges, while an onboarding agent can be limited to write access to customers. Each of these agents would hold its own restricted key rather than sharing one key that can do everything in the Stripe account.

The existing MCP and bring-your-own API key methods are unchanged, so teams that already use them do not need to switch.

How the managed key works

When creating a Stripe connector, users pick Managed API Key as the connection method and choose the permissions the key should have. Vercel then creates the key in the user's Stripe account. Vercel also stores it, so there is no secret key to paste into the setup.

Keys can be rotated from the connector's settings without redeploying. During rotation, the old key stays valid for up to 24 hours while the switch is made.

Setup from the dashboard or CLI

The connector can be created from the connectors directory: choose Managed API Key, pick the permissions, and attach the connector to a project. Setup can also start from the command line, which opens the browser to finish the process. Vercel shows two commands:

• Create: vercel connect create stripe --connection-method managed-api-key --name acme-stripe
• Attach: vercel connect attach stripe/acme-stripe --project my-app --environment production

At runtime, code retrieves the restricted key by calling getToken from the @vercel/connect package with the connector's UID, for example stripe/acme-stripe, and an app subject. The returned key is then passed to the Stripe client. Vercel's example uses it to list customers with the Stripe library.

What it means for teams running agents

For teams that let agents call Stripe, the change offers a way to apply narrower permissions per agent or task without handling secret keys by hand. Because Vercel creates and stores the key and supports rotation from the connector settings, the key does not need to be copied into project configuration. Vercel points users to the Stripe connector and its documentation to get started.