Vercel asks the ecosystem to abandon static credentials, yet its own deployment pipeline still relies on VERCEL_TOKEN
Vercel requires Marketplace vendors to switch to OIDC and short-lived tokens by January 2027 or face delisting; starting November 30, non-compliant integrations will be labeled Not secure. CTO Malte Ubl says a survey of more than 1,000 SaaS vendors found only 8.4% support the authentication methods it considers secure; yet Vercel's own GitHub Actions deployment guide still requires using the VERCEL_TOKEN secret, and developers have already pointed out this contradiction in replies. Vercel Connect supports requesting scoped credentials at runtime, but still allows static API keys for services lacking OAuth.
#Industry news#Safety / alignment#English text is being prepared.