Vercel Connect can create a restricted Stripe API key per agent or task, so agents stop running on a full-access secret key. Vercel announced it Oct. 23.
Vercel Connect can now create a separate restricted Stripe API key for each agent or task. Agents no longer have to run on a key that can do anything in the account. Vercel announced the Managed API Key option Oct. 23 (Vercel changelog, Oct. 23, 2026).
What Shipped #
Stripe is now a managed connector in Vercel Connect. When a developer creates a Stripe connector, Managed API Key appears as a connection method next to the existing MCP and bring-your-own-key options, which Vercel said are unchanged. Vercel creates the key inside the developer’s Stripe account, limited to the permissions the developer picks.
Vercel’s examples: a daily revenue report agent limited to read-only access to charges, and an onboarding agent limited to write access to customers. Vercel stores the key. Nothing gets pasted into an environment variable.
Developers rotate the key from the connector’s settings, with no redeploy. Vercel said the old key stays valid for up to 24 hours.
Setup runs through the dashboard or the CLI. Vercel’s changelog shows vercel connect create stripe --connection-method managed-api-key, followed by vercel connect attach to bind it to a project and environment. At runtime, code calls getToken from @vercel/connect with the connector’s UID and passes the result to the Stripe client.
What Stripe Says #
Vercel said most apps and agents run on Stripe’s default secret key, which has full access to the account. Stripe’s documentation calls restricted API keys the recommended type for keys given to AI agents. It says a restricted key limits the damage if the key is exposed. Its example is a key that can only read dispute data. That key cannot create charges, read payment methods or trigger payouts.
The Take #
Restricted keys are not new. Stripe has offered them for years. Vercel takes over the chores: creating one key per agent, scoping it, storing it and rotating it. Teams skip that work when one secret key already runs. Making the scoped key the path of least resistance is the change.
The limit is the same as ever. A restricted key is only as tight as the permissions chosen. Nothing stops a team from granting write access to everything. Someone still has to decide what each agent needs.
Key Takeaways #
- Vercel Connect added Managed API Key as a Stripe connection method Oct. 23, 2026.
- Each agent or task can get its own restricted key, limited to chosen permissions.
- Vercel stores the key. Rotation needs no redeploy, and the old key works for up to 24 hours.
- Stripe’s documentation recommends restricted keys for AI agents.