In this article
  1. What happened
  2. Why it matters
  3. What to do now
  4. Updates

TL;DR: Vercel has set deadlines for Marketplace vendors that still rely on API keys that never expire. In a post dated October 22, 2026, Vercel CTO Malte Ubl says that “by November 30, 2026, vendors who do not support OIDC auth from Vercel to their services and use long-lived secrets for authentication will have a similar ‘Not secure’ message on their listing” in the Vercel Marketplace, and that “by January 2027, vendors who do not offer secure auth will be delisted.” Vercel says it holds its own API and native integrations “to the same bar,” and that it is extending OIDC to the Vercel API and CLI. If you build on Vercel, now is a good time to list which of your environment variables are long-lived keys and which ones you can replace with short-lived tokens.

What happened

Vercel’s post, “Death to long-lived static credentials,” compares machine-to-machine authentication today to HTTPS in 2010: secure options exist, but static keys are still the default for many SaaS vendors. Vercel says:

  • It “surveyed more than 1,000 SaaS vendors and found that only 8.4% supported secure authentication methods.” The post doesn’t list the vendors or say how it defined “secure.”
  • Apps on Vercel can already use OIDC to reach Vercel Blob, AI Gateway and Sandbox “without storing long-lived keys for those services.” Its OIDC federation, generally available since 2024, swaps Vercel-issued identity tokens for temporary AWS, Google Cloud and Azure credentials under trust policies you set per project and environment.
  • Vercel Connect lets apps and agents use their deployment identity to request provider tokens at runtime, “without having to store long-lived provider secrets in environment variables.” The post’s example requests a read-only Linear token for a user with getToken from @vercel/connect.
  • OIDC UI is a new shadcn/ui component registry for API providers. Vercel says it includes a trust-policy configurator and a server-side token verifier, with forms for Vercel, GitHub, GitLab, Google, Bitbucket, AWS, Azure and custom OIDC issuers.
  • Vercel is “extending OIDC support across the Vercel API and CLI to remove the need for long-lived Vercel tokens in deployment workflows.” The post doesn’t give a date for that.

Vercel’s reasoning: a long-lived key can leak into a repository or a chat, be stolen when a service or dependency is compromised, or be revealed by an agent hit with prompt injection, and an attacker can then use it “until it expires or is revoked.” A short-lived OIDC token “stops working when it expires.” Vercel says it has “spent thousands of engineering hours on multiple, very painful key rotations” and never wants “to have to do this again.”

Why it matters

The timing isn’t abstract. This week, Railway told every customer to roll all environment variables after a third party may have decrypted some of them, and the LiteLLM 1.107.0 package on PyPI and Docker was caught stealing credentials. In both cases, the painful part for small teams was finding and rotating every static key. A short-lived token that expires on its own makes that job much smaller.

For small teams on Vercel, the deadline mostly affects which Marketplace add-ons you pick and how you connect cloud accounts. Vercel’s post doesn’t say whether integrations already installed from a delisted vendor keep working after January 2027. That’s our open question, not something Vercel has announced.

What to do now

  1. List your long-lived keys. In each Vercel project, go through the environment variables and note which are static API keys, database passwords or cloud access keys. That’s the list you’d have to rotate after a leak.
  2. Move cloud access to OIDC federation first. If a project stores AWS, Google Cloud or Azure access keys, Vercel’s OIDC federation docs show how to trust a specific project and environment and get temporary credentials instead. Then delete the old keys at the cloud provider, not just in Vercel.
  3. Watch the labels on Marketplace add-ons you use. By November 30, a “Not secure” message on a listing means that vendor still relies on long-lived secrets. Ask the vendor about its OIDC plans now, before the January 2027 delisting.
  4. Plan for the Vercel API and CLI change. If CI jobs or scripts use a long-lived Vercel token, expect an OIDC option to arrive. Until then, scope those tokens tightly and give them an expiry where you can.
  5. If you run an API others connect to from Vercel, look at OIDC UI and Vercel’s custom OIDC token audiences. Together, they let a customer’s Vercel project send your API a short-lived token scoped to your service, which you verify instead of asking for a pasted key.

Updates

  • Oct 23, 2026, 1:50 p.m. Manila: First published. We’ll add a dated note if Vercel publishes Marketplace requirements or a date for OIDC on the Vercel API and CLI.

Sources & method

Sources

Method. Last checked October 23, 2026, at 1:50 p.m. Manila time (05:50 UTC). The deadlines, the survey figure and the product details come from Vercel’s post and docs. We haven’t checked Vercel’s survey ourselves. The links to the Railway and LiteLLM incidents, the open question about existing installs, and the steps in “What to do now” are our own judgment, built on Vercel’s docs. No affiliate links on this page. How we work.

Spotted an error? See our corrections policy and tell us.