Vercel pushes to eliminate long-lived API keys but faces criticism over its own deployment token

Developers point out double standard as company mandates OIDC for Marketplace vendors by January 2027

By LineZotpaper AI staff

Published23 October 2026

Read Time2 min

Vercel has announced a push to eliminate long-lived static credentials from its ecosystem, giving Marketplace vendors until January 2027 to adopt more secure authentication or risk delisting. However, developers quickly noted that Vercel's own GitHub Actions deployment workflow still relies on the kind of persistent token the company now wants to kill, drawing accusations of a double standard.

In a Thursday announcement, Vercel CTO Malte Ubl said the company surveyed more than 1,000 SaaS vendors and found that only 8.4% support what Vercel considers secure authentication methods. The company is now promoting OpenID Connect (OIDC) and short-lived, identity-based tokens as alternatives to static API keys that can remain valid indefinitely. CEO Guillermo Rauch amplified the message on X, writing that it is 'time to kill static credentials' and arguing that stolen credentials should behave more like 'self-destructing keys' that expire before an attacker can use them.

However, senior software engineer at Fanatics, Yordis Prieto, responded directly to Rauch, noting that Vercel had 'invented' OIDC federation yet still left him relying on 'a long-lived access token' in his CI pipeline. Vercel's GitHub Actions deployment guide still instructs developers to authenticate deployments with a VERCEL_TOKEN secret, and Ubl acknowledged in the announcement that the company is extending OIDC support across its API and CLI to retire long-lived tokens from deployment workflows, leaving Vercel asking Marketplace vendors to adopt a standard its own deployment tooling has not fully implemented.

By November 30, Marketplace integrations that fall short of Vercel's authentication requirements will carry a 'Not secure' warning on their listing. The company has not published its survey methodology, named the companies it surveyed, or disclosed how many existing Marketplace partners will have to change their authentication systems.

Vercel's Connect service, which allows applications and agents to request scoped credentials at runtime, still supports static API keys for providers that lack OAuth or another identity-based option. Its documentation describes storing those credentials centrally and pulling them at runtime, while the underlying keys can still live indefinitely. The company introduced GitHub OIDC authentication for its Container Registry in late September, but that does nothing to remove the VERCEL_TOKEN requirement from its documented GitHub Actions deployment flow.

Analysis

Why This Matters

Developers using Vercel for deployments may be forced to change their CI/CD authentication while the company itself hasn't adopted the same standard.
Credential-stealing supply chain attacks have highlighted the danger of long-lived tokens; Vercel's push could improve industry security if consistently applied.
The deadline and warning labels for Marketplace vendors create urgency but also expose the gap between Vercel's policy and its own practices.

Background

Vercel is a cloud platform widely used for frontend deployment and serverless functions. Its Marketplace offers integrations with third-party services. The company has been advocating for short-lived, identity-based credentials to reduce the risk of stolen tokens persisting after an attack. Recent supply chain incidents, including an npm worm that scraped tokens from CI pipelines, have reinforced the need for better credential management. However, moving from static keys to OIDC requires changes across both platform providers and their users.

Key Perspectives

Vercel: Argues that static credentials are a security liability and that the industry should adopt short-lived tokens. CTO Malte Ubl cited a low rate of secure authentication adoption among vendors. The company says it is working to bring OIDC to its own tooling. Developers (e.g., Yordis Prieto): Point out that Vercel's own deployment guide still relies on a long-lived VERCEL_TOKEN, making the mandate for Marketplace vendors appear hypocritical. They press Vercel to drop the token requirement from GitHub CI. Critics/Skeptics: Security experts may note that Vercel Connect still supports static keys for providers without OAuth, and that the company has not disclosed the methodology behind its survey. The slow rollout of OIDC across Vercel's own workflows raises questions about how quickly Marketplace partners can comply.

What to Watch

November 30: Vercel begins adding 'Not secure' warnings to Marketplace integrations that fail authentication requirements.
January 2027 deadline: Whether Vercel will actually delist non-compliant vendors or extend the deadline.
Vercel's own GitHub Actions deployment flow: When OIDC support arrives, and whether the VERCEL_TOKEN requirement is removed.

Sources

Vercel moved to kill static credentials. Then developers spotted its own deployment token. · The New Stack

Checked

11 claims in this story checked against 1 source: 8 supported.

Show each claim

SupportedVercel faces criticism over its own deployment token.The New Stack: “Vercel’s own GitHub Actions deployment workflow still relies on the kind of persistent credential the company now wants gone. Developers have already pointed out a complication, though: Vercel’s own GitHub Actions deployment workflow still relies on the kind of persistent credential the company now wants gone.”
Partly supportedVercel mandates OIDC for Marketplace vendors by January 2027.The New Stack: “Vercel wants to eliminate long-lived API keys from its ecosystem, and it is giving Marketplace vendors until January 2027 to comply or risk being delisted”
SupportedDevelopers said Vercel’s GitHub Actions workflow still relies on a persistent credential.The New Stack: “Developers have already pointed out a complication, though: Vercel’s own GitHub Actions deployment workflow still relies on the kind of persistent credential the company now wants gone.”
SupportedVercel’s Thursday announcement said it surveyed more than 1,000 SaaS vendors and found that only 8.4% supported the authentication methods it considers secure.The New Stack: “In a Thursday announcement , Vercel CTO Malte Ubl says the company surveyed more than 1,000 SaaS vendors and found that only 8.4% supported what Vercel considers secure authentication methods”
Partly supportedRauch said stolen credentials should expire before an attacker can use them.The New Stack: “stolen credentials should behave more like “self-destructing keys” that expire before an attacker can keep using them.”
SupportedPrieto said Vercel had “invented” OIDC federation but still left him relying on “a long-lived access token” in his CI pipeline.The New Stack: “Yordis Prieto sharpens that point, writing in reply that Vercel had “invented” OIDC federation yet still left him leaning on “a long-lived access token” in his CI pipeline”
Partly supportedUbl acknowledged that Vercel is extending OIDC support across its API and CLI to retire long-lived deployment-workflow tokens.The New Stack: “in Thursday’s announcement Ubl says the company is extending OIDC support across its API and CLI to retire long-lived tokens from deployment workflows”
SupportedMarketplace integrations that fall short of Vercel’s authentication requirements will carry a “Not secure” warning on November 30.The New Stack: “By November 30, Marketplace integrations that fall short of Vercel’s authentication requirements will carry a “Not secure” warning on their listing”
SupportedVercel has not published its survey methodology, named the surveyed companies, or disclosed how many existing partners will need to change their authentication systems.The New Stack: “the company has not published its survey methodology, named the companies it surveyed, or disclosed how many existing Marketplace partners will have to change their authentication systems.”
SupportedVercel Connect still supports static API keys for providers without OAuth or another identity-based option, and those keys can remain valid indefinitely.The New Stack: “Vercel Connect still supports static API keys for providers that lack OAuth or another identity-based option, and its documentation describes storing those credentials centrally and pulling them at runtime, while the underlying keys can still live indefinitely.”
SupportedVercel introduced GitHub OIDC authentication for its Container Registry in late September, but that did not remove the VERCEL_TOKEN requirement from its documented GitHub Actions deployment flow.The New Stack: “The company also introduced GitHub OIDC authentication for its Container Registry in late September, though that work does nothing to remove the VERCEL_TOKEN requirement from its documented GitHub Actions deployment flow.”