Vercel sets Marketplace security deadlines for integrations using long-lived credentials

Vercel announced new security requirements for integrations sold through its Marketplace, focusing on providers that rely on long-lived credentials instead of identity-based authentication. From November 30, 2026, it plans to display a security warning on listings whose vendors do not support authentication from Vercel using OpenID Connect, or OIDC, and still depend on long-lived secrets. Vercel says it intends to delist vendors that fail to offer secure authentication in January 2027.

The company argues that persistent API keys and database passwords create security risks when copied into repositories or chats, or when leaked through compromised applications and AI agents. OIDC lets applications present short-lived identity tokens to services rather than embedding permanent credentials in deployment workflows. Receiving services still need to decide which permissions to grant.

Vercel says its survey of more than 1,000 software vendors found that only 8.4% supported the secure authentication methods it assessed. To support the change, the company introduced an OIDC UI component registry for configuring trust policies and verifying tokens. It also says it is expanding OIDC support across its API and command-line interface to reduce dependence on long-lived Vercel tokens. The warning and delisting dates are announced plans, not completed removals.