Connect Vercel
An account of Vercel is connected once, on the instance, by a person who then gives missions access to its resources; the agent never receives the credential. Runtime hosting plane — projects, deployments, logs, env vars, custom domains, firewall, preview comments.
One account is one Vercel access token pinned to a team; one resource is one project of that team. The environment is not a label you set: Vercel's own production, preview and development environments are read from each call, so the same project can run freely on preview and ask first on production.
Permissions, presets and tools of this service: Vercel plugin.
How to connect
On the instance: Accounts → Connect an account, then pick the service. A company app, when the service needs one, is registered once by an administrator under Settings → Administration → Company apps, or set in the configuration (providers.<id>.*, see configuration keys). Every instance registers its own app: this gateway never uses an app shared with another one.
The usual way: with a key pasted by hand
Where: https://vercel.com/account/settings/tokens
What the connect page asks:
- Access token (secret): Create a token in Account Settings → Tokens, scoped to the team you connect. Pick an expiration; the account needs reconnecting when it passes.
- Team ID: Team Settings → General → Team ID. Every call through this account is made on behalf of this team.
Disconnecting
Delete the access token in your Vercel account settings, under Tokens.
Registration notes from the plugin
From the plugin's README, written for the people who register the app or create the token.
Credential
api-key with two fields, collected by the host's generic form:
| Field | Secret | Value |
|---|---|---|
token | yes | A Vercel access token (Account Settings → Tokens), created with a scope limited to the team you connect. |
team_id | no | The team id (team_…, Team Settings → General). Every call of the connection acts on behalf of it. |
There is no OAuth app to register: Vercel's REST API and MCP server are both
reached with a personal access token, which is what works.
The token does not refresh (refresh is absent); pick an expiration when
creating it and reconnect when it expires. The team is pinned to the
credential: a teamId argument that is not exactly the connection's team
(another string, or any non-string) is refused before any network call, and
the value sent to Vercel is always written from the credential. The four
rewrapped tools that cannot carry a team are listed with their reason in
TEAMLESS_UPSTREAM_TOOLS (src/execute.ts).