# Connect Vercel

An account of Vercel is connected once, on the instance, by a person who then gives missions access to its resources; the agent never receives the credential. Runtime hosting plane — projects, deployments, logs, env vars, custom domains, firewall, preview comments.

One account is one Vercel access token pinned to a team; one resource is one project of that team. The environment is not a label you set: Vercel's own production, preview and development environments are read from each call, so the same project can run freely on preview and ask first on production.

Permissions, presets and tools of this service: [Vercel plugin](/plugins/vercel).

## How to connect

On the instance: Accounts → Connect an account, then pick the service. A company app, when the service needs one, is registered once by an administrator under Settings → Administration → Company apps, or set in the configuration (`providers.<id>.*`, see [configuration keys](/docs/configuration/keys)). Every instance registers its own app: this gateway never uses an app shared with another one.

### The usual way: with a key pasted by hand

Where: [https://vercel.com/account/settings/tokens](https://vercel.com/account/settings/tokens)

What the connect page asks:

- Access token (secret): Create a token in Account Settings → Tokens, scoped to the team you connect. Pick an expiration; the account needs reconnecting when it passes.
- Team ID: Team Settings → General → Team ID. Every call through this account is made on behalf of this team.

## Disconnecting

Delete the access token in your Vercel account settings, under Tokens.

## Registration notes from the plugin

From the plugin's [README](https://github.com/vaubaan/gateway/blob/main/plugins/vercel/README.md), written for the people who register the app or create the token.

### Credential

`api-key` with two fields, collected by the host's generic form:

| Field     | Secret | Value                                                                                                    |
| --------- | ------ | -------------------------------------------------------------------------------------------------------- |
| `token`   | yes    | A Vercel access token (Account Settings → Tokens), created with a scope limited to the team you connect. |
| `team_id` | no     | The team id (`team_…`, Team Settings → General). Every call of the connection acts on behalf of it.      |

There is no OAuth app to register: Vercel's REST API and MCP server are both
reached with a personal access token, which is what works.
The token does not refresh (`refresh` is absent); pick an expiration when
creating it and reconnect when it expires. The team is pinned to the
credential: a `teamId` argument that is not exactly the connection's team
(another string, or any non-string) is refused before any network call, and
the value sent to Vercel is always written from the credential. The four
rewrapped tools that cannot carry a team are listed with their reason in
`TEAMLESS_UPSTREAM_TOOLS` (`src/execute.ts`).