Vercel pushes to eliminate long-lived API keys but faces criticism over its own deployment token
Developers point out double standard as company mandates OIDC for Marketplace vendors by January 2027
Vercel has announced a push to eliminate long-lived static credentials from its ecosystem, giving Marketplace vendors until January 2027 to adopt more secure authentication or risk delisting. However, developers quickly noted that Vercel's own GitHub Actions deployment workflow still relies on the kind of persistent token the company now wants to kill, drawing accusations of a double standard.