Vercel sets deadlines for Marketplace vendors to drop long-lived credentials
Marketplace vendors without OIDC support will get a "Not secure" label by 30 November 2026 and be delisted by January 2027.
Vercel said on 22 October it is pushing to replace long-lived static credentials, such as API keys and database passwords, with short-lived, identity-based authentication using OIDC.
Vercel says it surveyed more than 1,000 SaaS vendors and found that only 8.4% supported secure authentication methods. It names three barriers: complex tooling and setup, added latency from fetching tokens, and weak incentives for vendors.
Deadlines
By 30 November 2026, Marketplace vendors that do not support OIDC auth from Vercel and rely on long-lived secrets will show a "Not secure" message on their listing. By January 2027, vendors that do not offer secure auth will be delisted. Vercel says it holds its own API and native integrations to the same bar.
Vercel also announced OIDC UI, a shadcn/ui registry with trust-policy forms and token verification code for providers, and says it is extending OIDC support across the Vercel API and CLI.