Vercel Connect adds Enterprise-Managed Authorization
By Steven Van ·
Connect's public beta lets apps and agents reach services as signed-in users, with admins granting or revoking access through the identity provider.
Vercel Connect now supports Enterprise-Managed Authorization (EMA) in public beta. Vercel says apps and agents can access supported services on behalf of signed-in users without a separate consent prompt for each service, as described in the Connect announcement.
How access works
- Admin-managed access: administrators can grant or revoke access to supported services through the identity provider.
- Corporate sign-in: users sign into the app with their corporate account through a compatible identity provider such as Okta.
- Scoped tokens: the app requests the scopes it needs, and Connect handles token exchange, caching and renewal. Access is limited to approved scopes and the user's existing service permissions.
Using it with Vercel Passport
An app that uses Vercel Passport can request a token for Slack's Model Context Protocol (MCP) server with the signed-in user's identity. In the example, the app gets the identity with requireIdentity() from @vercel/passport, then passes it as the subject, along with the scopes, to getToken from @vercel/connect.
Setup
Connect supports Cross-App Access (XAA), including its use for MCP authorization through EMA. Setup means configuring the identity provider and the services, then enabling EMA on their Connect connectors, which the Vercel Connect EMA setup guide covers.
