Vercel sets deadlines to move Marketplace providers off static credentials
Vercel will label noncompliant integrations in November and delist providers without secure authentication by January.
Vercel is pushing Marketplace providers toward short-lived, identity-based authentication, with deadlines for services that still rely on persistent secrets.
The Marketplace deadlines
By November 30, 2026, listings for vendors using long-lived secrets without supporting OIDC authentication from Vercel will receive a “Not secure” label.
By January 2027, vendors that do not offer secure authentication will be delisted. Vercel says its API and native integrations face the same standard.
Why temporary credentials matter
OpenID Connect lets an application prove its identity using a signed, expiring token. A receiving service can verify that identity before granting access, reducing reliance on reusable provider keys stored in application configuration.
Vercel is also extending OIDC support across its API and CLI. The announcement establishes a transition toward temporary credentials; it does not specify an immediate universal revocation of existing API keys.