Vercel Connect adds Enterprise-Managed Authorization

Vercel Connect, the service that obtains and manages credentials so apps and agents can call other services, now has a public-beta mode in which a company's identity provider decides which of those services an app may reach on a user's behalf (vercel.com). Vercel calls this Enterprise-Managed Authorization. Instead of each employee approving a separate consent prompt for every service an app or agent touches, they sign in once with their corporate account through a compatible provider such as Okta, and administrators grant or revoke the app's access to supported services centrally in that provider.

Behind the scenes, the app asks for the permission scopes it needs and Connect exchanges the user's identity for service tokens, then caches and renews them. Vercel says the resulting access is limited to scopes that were approved and to permissions the user already has in the target service. The changelog's example pairs this with Vercel Passport, which handles corporate sign-in for a deployment: the app takes the signed-in Passport identity and requests a token for Slack's Model Context Protocol (MCP) server.

The mechanism underneath is Cross-App Access, the informal name for the pattern in an IETF draft that lets an app use a signed-in user's identity assertion to get an access token for another service's API, by going through the identity provider that service already trusts for single sign-on. Connect supports it, including for authorizing MCP servers. The feature only works with services and identity providers that support this flow, and it is a public beta, so which services work is set by Vercel's EMA setup guide and by each provider's own support.