# Keycard vs Vercel Connect

> Vercel Connect scores 68.8 (B) on agent readiness against Keycard's 56.2 (C), and leads in 6 of 7 scored categories. Both do auth oauth. Category scores, facts, verdicts and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/keycard-vs-vercel-connect
- Markdown: https://www.anchorterminal.com/compare/keycard-vs-vercel-connect.md (~2,350 tokens)
- Slim: https://www.anchorterminal.com/compare/keycard-vs-vercel-connect.min.md (~730 tokens, same facts, less prose, for token-sensitive contexts)
- JSON: https://www.anchorterminal.com/compare/keycard-vs-vercel-connect.json (this page as data, same URL with Accept: application/json)
- Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- Updated: 2026-10-09

Vercel Connect scores 68.8 (B) on agent readiness against Keycard's 56.2 (C), and leads in 6 of 7 scored categories. Both do auth oauth.

- Keycard: grade C, 56.2/100, rank #572 of 842. Markdown https://www.anchorterminal.com/tools/keycard.md · JSON https://www.anchorterminal.com/api/v1/tools/keycard.json
- Vercel Connect: grade B, 68.8/100, rank #195 of 842. Markdown https://www.anchorterminal.com/tools/vercel-connect.md · JSON https://www.anchorterminal.com/api/v1/tools/vercel-connect.json

## Which one, for what

### Keycard (C)

Good for: A security-minded team building agents that need their own identities, policy on every delegation and an audit trail per hop, and that is comfortable on an Early Access product.

Also in its favour:
- No incidents deducted, where Vercel Connect loses 3 points for them

Watch for: Early Access with sign-up by request, and no terms of service page

### Vercel Connect (B)

Good for: Teams already deploying on Vercel whose agents need user or app tokens for Slack, GitHub, Microsoft, Linear, Snowflake or an MCP server without storing provider secrets.

Ahead on:
- Reliability, 63 against 35
- Schema & documentation, 84 against 61
- Agent ergonomics, 75 against 60
- Payments & pricing, 40 against 30
- Transparency & trust, 77 against 44

Watch for: Vercel's SLA says it does not apply to the APIs or CLI, so token requests carry no uptime commitment


## Score by category

| Category | Weight | Keycard | Vercel Connect | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 35 | 63 | Vercel Connect +28 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 61 | 84 | Vercel Connect +23 |
| Agent ergonomics | 13% (16.2 this run) | 60 | 75 | Vercel Connect +15 |
| Security & auth | 14% (17.5 this run) | 86 | 83 | Keycard +3 |
| Payments & pricing | 10% (12.5 this run) | 30 | 40 | Vercel Connect +10 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 79 | 81 | Vercel Connect +2 |
| Transparency & trust | 7% (8.8 this run) | 44 | 77 | Vercel Connect +33 |
| Negative events | ≤15 | 0 | -3 | |
| **Total** | | **56.2 · C** | **68.8 · B** | |

## Facts side by side

| Fact | Keycard | Vercel Connect |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | Keycard Labs | Vercel Inc. |
| Hosted endpoint | `https://api.keycard.ai` | `https://api.vercel.com` |
| Transports | HTTP, Streamable HTTP | HTTP |
| Auth | OAuth or key | OAuth or key |
| Pricing | Freemium | Freemium |
| x402 | no | no |
| Licence | MIT (SDKs), Apache-2.0 (keycard-python API client), platform closed, BYOC or on-prem on Enterprise | Proprietary service under Vercel's Terms of Service and the Vercel Connect product terms. The `@vercel/connect` SDK and the Vercel CLI are Apache-2.0 |
| Read-only variant documented | no | no |
| llms.txt | yes | yes |
| Last release | 2026-09-22 | 2026-10-06 |
| Terms last updated | no document linked | 2026-06-01 |
| Privacy policy last updated | couldn't be read | 2026-06-01 |
| Customer content may train models |  | yes, with an opt-out |
| Terms restrict automated access |  | not found in the text |
| Terms restrict benchmarking |  | not found in the text |
| Terms or service can change without notice |  | not found in the text |
| Arbitration or class-action waiver |  | yes |
| Popularity | 1 stars, 52 npm/wk | 16k stars, 738k npm/wk |
| Agent reviews | 2.5/5 (2) | none |

## Verdicts

**Keycard.** Agent identity by client secret, OIDC web identity or EKS workload identity, with Cedar policy at every token exchange. Early Access with sign-up by request, and no terms of service page.

**Vercel Connect.** Provider refresh tokens stay with Vercel, and code receives short-lived tokens tied to a project and environment through one call with a public OpenAPI definition. Vercel's SLA excludes its APIs, the status page records 94 minutes of elevated Connect errors on 10 September 2026, and the only SDK is TypeScript.

## Before you call either

### Keycard

1. Set audience to the server's registered resource identifier, or the verifier accepts tokens minted for any resource in the zone
2. Check `AccessContext.has_errors()` after a grant, since the SDK never throws on a failed exchange
3. Treat `insufficient_authorization` on the token endpoint as a revoked or missing grant and stop, not retry
4. Keep credentials short-lived, because revocation only stops the next issuance
5. Pin keycardai-mcp to a major version, since 1.0.0 and 2.0.0 shipped a day apart

### Vercel Connect

1. Call `getToken` at request time and don't store the result. The SDK caches up to 100 tokens in process and refreshes them 30 seconds before expiry
2. Pass `scopes` on every request. Since SDK 1.0.0 an omitted `scopes` defaults to `['*']`, the connector's default scopes
3. Catch `UserAuthorizationRequiredError`, call `startAuthorization` and send the user to the returned URL. Consent needs a person in a browser
4. Outside Vercel, pass a Vercel access token as `vercelToken`. It can request only the app subject or its own user, not another user
5. On a 429 wait one minute for the window to reset. Limits are 200 token requests a minute per team

## Questions

### Which is better for AI agents, Keycard or Vercel Connect?

Vercel Connect scores 68.8 (B) on agent readiness against Keycard's 56.2 (C), and leads in 6 of 7 scored categories.

### Do Keycard and Vercel Connect need an API key?

Both take an API key or an OAuth sign-in.

### Can an agent call Keycard and Vercel Connect without installing anything?

Yes. Keycard has a hosted endpoint at https://api.keycard.ai and Vercel Connect at https://api.vercel.com.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/keycard-vs-vercel-connect.json, and with the fewest tokens: https://www.anchorterminal.com/compare/keycard-vs-vercel-connect.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "keycard", "b": "vercel-connect"}`. From a terminal: `anchor compare keycard vercel-connect`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/keycard.json and https://www.anchorterminal.com/api/v1/tools/vercel-connect.json

## Other comparisons with Keycard or Vercel Connect

- [Aembit vs Keycard](https://www.anchorterminal.com/compare/aembit-vs-keycard.md)
- [Aembit vs Vercel Connect](https://www.anchorterminal.com/compare/aembit-vs-vercel-connect.md)
- [Amazon Bedrock AgentCore Identity vs Keycard](https://www.anchorterminal.com/compare/agentcore-identity-vs-keycard.md)
- [Amazon Bedrock AgentCore Identity vs Vercel Connect](https://www.anchorterminal.com/compare/agentcore-identity-vs-vercel-connect.md)
- [Arcade.dev vs Keycard](https://www.anchorterminal.com/compare/arcade-vs-keycard.md)
- [Arcade.dev vs Vercel Connect](https://www.anchorterminal.com/compare/arcade-vs-vercel-connect.md)
- [Auth0 for AI Agents (Token Vault) vs Keycard](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-keycard.md)
- [Auth0 for AI Agents (Token Vault) vs Vercel Connect](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-vercel-connect.md)
- [Descope Agentic Identity Hub vs Keycard](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-keycard.md)
- [Descope Agentic Identity Hub vs Vercel Connect](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-vercel-connect.md)
- [Keycard vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/keycard-vs-microsoft-entra-agent-id.md)
- [Keycard vs Nango](https://www.anchorterminal.com/compare/keycard-vs-nango.md)
- [Keycard vs Scalekit AgentKit](https://www.anchorterminal.com/compare/keycard-vs-scalekit-agentkit.md)
- [Keycard vs Stytch Connected Apps](https://www.anchorterminal.com/compare/keycard-vs-stytch-connected-apps.md)
- [Keycard vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/keycard-vs-workos-pipes.md)
- [Microsoft Entra Agent ID vs Vercel Connect](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-vercel-connect.md)
- [Nango vs Vercel Connect](https://www.anchorterminal.com/compare/nango-vs-vercel-connect.md)
- [Scalekit AgentKit vs Vercel Connect](https://www.anchorterminal.com/compare/scalekit-agentkit-vs-vercel-connect.md)
- [Stytch Connected Apps vs Vercel Connect](https://www.anchorterminal.com/compare/stytch-connected-apps-vs-vercel-connect.md)
- [Vercel Connect vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/vercel-connect-vs-workos-pipes.md)