Vercel is ordering Marketplace vendors to eliminate long-lived API keys by January 2027 or face delisting, even as the company's own GitHub Actions deployment workflow still depends on the persistent credentials it now wants banned, according to a Thursday announcement from the platform company. The push comes amid a wave of credential-stealing supply chain attacks, including a recent npm worm that extracted tokens directly from CI pipelines, demonstrating the damage a single leaked secret can inflict. Vercel surveyed more than 1,000 SaaS vendors and discovered that just 8.4% supported what the company considers secure authentication methods, prompting its push for OpenID Connect (OIDC) and short-lived, identity-based tokens as replacements for static API keys that can remain valid indefinitely.
Vercel CTO Malte Ubl says the company is extending OIDC support across its API and CLI to retire long-lived tokens from deployment workflows, while CEO Guillermo Rauch wrote on X that it's "time to kill 'static credentials,'" arguing that stolen credentials should behave like "self-destructing keys" that expire before attackers can exploit them. By November 30, Marketplace integrations failing to meet Vercel's authentication requirements will display a "Not secure" warning on their listings. The company hasn't published its survey methodology, named the surveyed companies, or disclosed how many existing Marketplace partners will need to overhaul their authentication systems.
Developer Yordis Prieto, a senior software engineer at Fanatics, pointed out that Vercel had "invented" OIDC federation yet still left him relying on "a long-lived access token" in his CI pipeline, pressing the company to remove the token requirement from GitHub CI. Vercel's GitHub Actions deployment guide still tells developers to authenticate deployments with a VERCEL_TOKEN secret, leaving Vercel asking Marketplace vendors to adopt a standard its own deployment tooling hasn't fully implemented. The company introduced GitHub OIDC authentication for its Container Registry in late September, though that work doesn't eliminate the VERCEL_TOKEN requirement from its documented GitHub Actions deployment flow.
As AI agents gain access to more external services, credential management is becoming a more pressing concern for agent harnesses, and short-lived, just-in-time credentials that expire offer one way to reduce the risks of persistent access keys rather than leaving agents with ongoing access. Vercel's Connect service tackles part of that problem by letting applications and agents request scoped credentials at runtime using their deployment identity instead of storing secrets in application environments, and Connect also handles token exchange and renewal. An October 15 update added enterprise-managed authorization in public beta, allowing administrators to control access to supported services through identity providers like Okta. Even so, Vercel Connect still supports static API keys for providers lacking OAuth or another identity-based option, and its documentation describes storing those credentials centrally and pulling them at runtime, while the underlying keys can still live indefinitely. For now, Vercel faces the same job it's handing its Marketplace vendors: replacing long-lived credentials across infrastructure it already runs, and until OIDC support reaches workflows like GitHub Actions deployments, developers will keep needing the very tokens Vercel is urging the rest of the industry to give up. The company's roadmap hasn't set a public timeline for when its own workflows will be free of the persistent secrets it's now calling a security liability. Vendors betting their roadmap position on credential modernization may find themselves navigating a transition their platform provider hasn't fully charted, while enterprises weighing zero-trust architectures will watch whether enforcement precedes or follows internal compliance.