Vercel Connect can give each agent its own restricted Stripe key

Vercel Connect can now create a separate restricted Stripe API key for each agent or task. When you set up a Stripe connector, you can choose Managed API Key as the connection method. Vercel creates the key in your Stripe account, limited to the permissions you pick, and stores it for you.

A leaked key exposes only what its job needs

Vercel says most apps and agents run on Stripe’s default secret key, which has full access to the account. If an agent with that key misbehaves, or the key leaks, the damage reaches everything in your Stripe account.

A per-agent key limits that exposure. In Vercel’s examples, a daily revenue report agent gets read-only access to charges, and an onboarding agent gets write access to customers. The report agent cannot create customers, and the onboarding agent cannot read charges.

Setup and rotation

Create a Stripe connector from the connectors directory, choose Managed API Key, pick the permissions, and attach the connector to your project. You can also start from the Vercel CLI, which opens the browser to finish setup. There is no secret key to paste.

You can rotate the key from the connector’s settings without redeploying. The old key stays valid for up to 24 hours while you switch over.

The existing MCP and bring-your-own API key methods are unchanged, so current connectors keep working. An agent that already uses your full Stripe secret key can move to a managed key limited to the permissions its task needs.

End of article