Vercel pushes vendors to adopt OIDC, but its own deployment token remains static

Vercel's Push for Secure Authentication

Vercel announced a mandate for its Marketplace vendors to transition to OpenID Connect (OIDC) and short-lived, identity-based tokens by January 2027. This initiative aims to eliminate long-lived API keys, which pose security risks, especially in light of recent credential-stealing supply chain attacks. Vercel CTO Malte Ubl stated that a survey of over 1,000 SaaS vendors revealed only 8.4% supported secure authentication methods.

The Inconsistency in Vercel's Own Practices

Despite advocating for the deprecation of static credentials, developers quickly pointed out an inconsistency: Vercel's own GitHub Actions deployment workflow continues to rely on a persistent token. This means Vercel is asking its partners to adopt a standard that its internal tooling has not yet fully implemented, leading to criticism from the developer community.

Developer Feedback and Company Response

Developers, including Fanatics senior software engineer Yordis Prieto, highlighted that Vercel's GitHub Actions deployment guide still instructs users to authenticate with a `VERCEL_TOKEN` secret. Ubl acknowledged this in the announcement, stating that Vercel is extending OIDC support across its API and CLI to eventually retire long-lived tokens from deployment workflows. For now, this leaves Vercel in a position of requiring a standard from vendors that its own systems are still transitioning to.

Implications for Marketplace Vendors

Marketplace integrations that do not meet Vercel's new authentication requirements will receive a 'Not secure' warning on their listings by November 30. The company has not disclosed details about its survey methodology, the specific companies surveyed, or the number of existing Marketplace partners affected by this policy change.