Vercel has announced a push to remove long-lived API keys from its whole ecosystem. Marketplace integrations have until January 2027 to switch to OpenID Connect and short-lived, identity-based tokens, or risk being delisted.

Developers quickly pointed out an awkward detail: the official guide for deploying through GitHub Actions still tells users to store a persistent VERCEL_TOKEN as a secret, which is exactly the kind of key the company wants everyone else to drop.

What Vercel is asking for

According to CTO Malte Ubl, the company surveyed more than 1,000 SaaS vendors and found that only 8.4% supported authentication methods Vercel considers secure. The proposed alternative to static keys that can stay valid indefinitely is OIDC with short-lived tokens issued to a specific identity.

CEO Guillermo Rauch framed it this way: breaches will still happen, but stolen credentials should act like “self-destructing keys” that expire before an attacker can keep using them. From November 30, integrations that fall short will carry a “Not secure” label in the catalog. Vercel has not disclosed its survey methodology or the companies surveyed.

A double standard in deployment

Fanatics engineer Yordis Prieto publicly noted that Vercel offers OIDC federation, yet his CI pipeline still depends on a long-lived token, and a non-expiring option is available too. In the announcement Ubl said OIDC support is being extended across the API and CLI to retire persistent tokens from deployment workflows, but no date has been given for GitHub Actions.

For agents and apps Vercel already has Connect, which issues scoped credentials at runtime based on the deployment identity and handles token renewal. Still, for providers without OAuth, Connect keeps static keys, just stored centrally.

Commentary

The direction is right: the run of supply chain attacks, including a recent npm worm that scraped tokens straight out of CI, shows how much damage one leaked secret can do. There is no need to wait for the platform to finish its OIDC work, though. Repository secrets are worth auditing now: issue tokens with minimal scope and an expiry date, rotate them regularly, and switch to OIDC from GitHub Actions wherever the hosting or cloud provider supports it.

Source: The New Stack.