Vercel vs Static Credentials: OIDC Push Comes With a Catch

Vercel surveyed more than 1,000 SaaS vendors and found that only 8.4% supported what it considers secure authentication. It now wants long-lived API keys out of its Marketplace, with a “Not secure” label from November 30 and possible delisting after January 2027. Its own GitHub Actions deployment guide, though, still tells developers to store a long-lived Vercel token. For platform teams, the gap between the policy and the tooling shows how hard retiring static secrets still is.

What Happened

In Vercel’s announcement, the company argues that machine-to-machine authentication looks like HTTPS did in 2010. Long-lived credentials can leak into repos or chats, be stolen in a supply-chain compromise, or be exposed when prompt injection leads an agent to reveal them. Vercel says it has spent thousands of engineering hours on painful key rotations. Its answer is OpenID Connect (OIDC): a trusted issuer signs a short-lived token identifying the application, and the receiving service verifies it before granting access.

The New Stack reports the Marketplace deadlines. Integrations that fall short get the “Not secure” warning from November 30, and vendors have until January 2027 to comply or risk delisting. The New Stack points out that Vercel hasn’t published its survey methodology, named the vendors, or said how many current Marketplace partners will need to change.

Why It Matters

Vercel names three barriers to adoption: setup that is more complicated than pasting a key, latency from fetching or exchanging tokens, and weak vendor incentives. It’s addressing each:

• OIDC UI, a shadcn/ui registry with trust-policy forms and token verification code for GitHub, GitLab, Google, AWS, Azure and other issuers
• Platform-issued tokens in Vercel Functions request headers, reused while unexpired, so reading one needs no extra network call (custom-audience and provider exchanges still do)
• Vercel Connect, which lets applications and agents request scoped provider tokens at runtime using their deployment identity

Vercel’s OIDC federation has been generally available since 2024 for exchanging Vercel identity tokens for temporary AWS, Google Cloud and Azure credentials. The idea mirrors the pattern Stack Archive covered in Terraform’s AWS dynamic credentials.

The Catch

Developers quickly pointed out the inconsistency. The New Stack notes that Vercel’s GitHub Actions guide still authenticates deployments with a VERCEL_TOKEN secret, and Vercel Connect still supports static API keys for providers without OAuth or another identity-based option. Vercel says it’s extending OIDC across its API and CLI to remove long-lived Vercel tokens from deployment workflows, but gives no date. The New Stack also notes that Vercel added GitHub OIDC login for its Container Registry in late September, which doesn’t change the deployment flow.

Source: The New Stack

Content created with AI assistance and reviewed for accuracy.