From 319c1bbb871a8ad00ae3ebd2937c806b614e3fa6 Mon Sep 17 00:00:00 2001 From: dvoytenko Date: Wed, 14 Oct 2026 14:16:38 -0700 Subject: [PATCH] [skills] Document Passport identities in Vercel Connect --- skills/vercel-connect/SKILL.md | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) diff --git a/skills/vercel-connect/SKILL.md b/skills/vercel-connect/SKILL.md index dbb6b052..012c2ddc 100644 --- a/skills/vercel-connect/SKILL.md +++ b/skills/vercel-connect/SKILL.md @@ -1,6 +1,6 @@ --- name: vercel-connect -description: Vercel Connect expert guidance for securely obtaining scoped credentials for third-party services on behalf of apps or users. Use when wiring up provider API access, OAuth, API-key services, MCP servers, triggers, framework adapters, or eve agent connections. +description: Vercel Connect expert guidance for securely obtaining scoped credentials for third-party services on behalf of apps or users. Use when wiring up provider API access, OAuth, API-key services, MCP servers, triggers, framework adapters, eve agent connections, or provider tokens for Passport-authenticated users. metadata: priority: 5 docs: @@ -48,12 +48,15 @@ metadata: - "notion token" - "salesforce connection" - "api key connector" + - "passport identity" + - "passport-authenticated user" allOf: - [slack, token] - [github, token] - [oauth, token] - [mcp, connect] - [mcp, server] + - [passport, token] anyOf: - "vercel connect" - "@vercel/connect" @@ -86,10 +89,14 @@ retrieval: - add snowflake connection - connect an AI SDK app to an authenticated MCP server - configure Connect triggers + - get a provider token for a Passport-authenticated user entities: - Vercel Connect - getToken - "@vercel/connect" + - "@vercel/passport" + - requireIdentity + - Passport - OAuth - Slack - GitHub @@ -105,6 +112,7 @@ retrieval: - wire up Linear in my eve agent - connect my agent to a MCP server - add Snowflake credentials to my project + - use my Passport identity to get a Slack token chainTo: - pattern: "from\\s+['\"]@vercel/connect/eve['\"]" @@ -213,6 +221,24 @@ Use these root APIs when needed: - `revokeToken()` and `deleteTokenCacheEntry()` for revocation and cache eviction. - `forceRefresh` and `validityBufferMs` only when the default cache behavior does not fit the call. +#### Passport-authenticated users: `@vercel/passport` + +If the application already authenticates users with Passport, pass the identity returned by `requireIdentity()` directly as the Connect `subject`. There is no need to manually construct a separate user subject: + +```typescript +import { getToken } from "@vercel/connect"; +import { requireIdentity } from "@vercel/passport"; + +const identity = await requireIdentity(); + +const token = await getToken("slack/xaa-slack", { + subject: identity, + scopes: ["users:read"], +}); +``` + +Keep both calls on the server. Replace `slack/xaa-slack` with your linked connector UID and request only the scopes needed by the operation; `users:read` is the scope used in this example. Passport supplies the authenticated user identity, while Connect supplies the provider API token. Connector attachment and provider authorization requirements still apply. + #### eve agents: `@vercel/connect/eve` When the project is built on [eve](https://eve.dev), prefer the `connect` helper over calling `getToken` directly inside connection definitions. It wires token requests and interactive authorization into eve's connection runtime: