Vercel is enforcing a shift away from long-lived API keys across its Marketplace ecosystem, setting a January 2027 deadline for vendors to migrate to OpenID Connect (OIDC) or face delisting. The initiative arrives amid a series of supply chain attacks where stolen credentials have been extracted directly from CI pipelines, underscoring the risk posed by credentials that never expire.
Yet a contradiction has emerged: Vercel's own deployment automation on GitHub Actions still depends on static tokens—the very credential type the company is now pushing out of its platform. According to Vercel CTO Malte Ubl, a survey of over 1,000 SaaS vendors revealed that just 8.4% currently support what Vercel considers secure authentication methods. The company is promoting OIDC and short-lived, identity-based tokens as replacements for API keys that can remain valid indefinitely.
Vercel CEO Guillermo Rauch reinforced the message on X, stating that it is "time to kill 'static credentials'" and contending that while breaches cannot be prevented entirely, stolen credentials ought to function as "self-destructing keys" that expire before attackers can continue exploiting them.
The deployment inconsistency
Yordis Prieto, a senior software engineer at Fanatics, highlighted the contradiction by noting that Vercel had "invented" OIDC federation yet still required him to use "a long-lived access token" in his CI pipeline. He called on Vercel to eliminate the token requirement from GitHub CI and discontinue its non-expiring token option.
Vercel's GitHub Actions deployment documentation continues to direct developers to authenticate using a VERCEL_TOKEN secret. While Ubl announced that the company is broadening OIDC support across its API and CLI to phase out long-lived tokens from deployment workflows, this means Vercel is currently asking Marketplace vendors to adopt a standard that its own deployment infrastructure has not yet fully rolled out.
Starting November 30, Marketplace integrations that do not meet Vercel's authentication standards will display a "Not secure" warning on their listing. Vercel has not released details about its survey methodology, identified which companies participated, or revealed how many existing Marketplace partners will need to overhaul their authentication systems.
Short-lived credentials for AI agents
As AI agents obtain broader access to external services, managing credentials has become increasingly important for agent platforms. One approach to limiting the danger of persistent access keys involves using short-lived, just-in-time credentials that expire rather than granting agents indefinite access.
Vercel's Connect service addresses this challenge by enabling applications and agents to request scoped credentials at runtime using their deployment identity, eliminating the need to store secrets in application environments. Connect manages token exchange and renewal automatically.
An October 15 update introduced enterprise-managed authorization in public beta, giving administrators the ability to manage access to supported services via identity providers including Okta.
Connect's static key fallback
Nevertheless, Vercel Connect continues to accept static API keys for providers that do not support OAuth or other identity-based authentication. Its documentation recommends storing these credentials in a central location and retrieving them at runtime, though the underlying keys themselves can persist indefinitely.
Vercel also rolled out GitHub OIDC authentication for its Container Registry in late September, but this addition does not address the VERCEL_TOKEN requirement in its published GitHub Actions deployment instructions.
OIDC rollout across Vercel infrastructure
Vercel now faces the same challenge it is imposing on Marketplace vendors: retiring long-lived credentials from its own infrastructure. Until OIDC integration reaches deployment workflows such as GitHub Actions, developers will continue to depend on the tokens that Vercel is urging the broader industry to eliminate.