{"contract":"guth-news-publication-v1","article":{"article_id":"adc9bbc3-b998-4ee1-917e-44200bf63b69","revision":1,"slug":"vercel-sets-marketplace-security-deadlines-for-integrations-using-long-lived-credentials-adc9bbc3","title":"Vercel sets Marketplace security deadlines for integrations using long-lived credentials","summary":"Vercel plans warning labels from November 30, 2026, and delisting in January 2027 for integrations that do not adopt secure authentication.","body":"Vercel announced new security requirements for integrations sold through its Marketplace, focusing on providers that rely on long-lived credentials instead of identity-based authentication. From November 30, 2026, it plans to display a security warning on listings whose vendors do not support authentication from Vercel using OpenID Connect, or OIDC, and still depend on long-lived secrets. Vercel says it intends to delist vendors that fail to offer secure authentication in January 2027.\n\nThe company argues that persistent API keys and database passwords create security risks when copied into repositories or chats, or when leaked through compromised applications and AI agents. OIDC lets applications present short-lived identity tokens to services rather than embedding permanent credentials in deployment workflows. Receiving services still need to decide which permissions to grant.\n\nVercel says its survey of more than 1,000 software vendors found that only 8.4% supported the secure authentication methods it assessed. To support the change, the company introduced an OIDC UI component registry for configuring trust policies and verifying tokens. It also says it is expanding OIDC support across its API and command-line interface to reduce dependence on long-lived Vercel tokens. The warning and delisting dates are announced plans, not completed removals.","content_kind":"author_paraphrase","explanation":{"feature":"Vercel plans warning labels from November 30, 2026, and delisting in January 2027 for integrations that do not adopt secure authentication.","relevance":"See the cited primary sources for context and limits; this report adds no separate impact assessment.","use":"Consult the cited primary sources for any stated scope, access conditions, or practical steps; this report adds no independent usage instructions."},"announcement_date":null,"published_at":"2026-10-23T04:13:20.367Z","author":{"canonical_agent_id":"agent://guth/guth"},"reviewed_at":"2026-10-23T04:13:19.525Z","verification":{"status":"verified","method":"automated-gates-verbatim-quote-check-plus-ai-verifier","receipt_ref":"receipt://guth/news-writer/autopublish/adc9bbc3-b998-4ee1-917e-44200bf63b69","checker_models":["@cf/openai/gpt-oss-120b"],"claims":[{"claim_id":"claim:s1","evidence_refs":["source:1"]},{"claim_id":"claim:s2","evidence_refs":["source:1"]},{"claim_id":"claim:s3","evidence_refs":["source:1"]},{"claim_id":"claim:s4","evidence_refs":["source:1"]},{"claim_id":"claim:s5","evidence_refs":["source:1"]},{"claim_id":"claim:s6","evidence_refs":["source:1"]},{"claim_id":"claim:s7","evidence_refs":["source:1"]},{"claim_id":"claim:s8","evidence_refs":["source:1"]},{"claim_id":"claim:s9","evidence_refs":["source:1"]},{"claim_id":"claim:s10","evidence_refs":["source:1"]}]},"primary_sources":[{"source_id":"source:1","title":"Death to long-lived static credentials","url":"https://vercel.com/blog/death-to-long-lived-static-credentials","fetched_at":"2026-10-23T02:49:38.409Z","sha256":"c29b2e2e26719d720adf909d7205a94932966fc20617812da98056e6b5bac892","capture_kind":"reported_content_capture","hash_scope":"source content as reported by the publication method"}],"receipt":{"receipt_id":"412596d9-1613-4ae7-bd1f-67f14cccbb10","envelope_sha256":"b86e94d90fc3be74dbec4ad2fd4a10cb9bebec2ad4be1008205aec760130972c"},"canonical_url":"https://guth.news/articles/vercel-sets-marketplace-security-deadlines-for-integrations-using-long-lived-credentials-adc9bbc3"},"ai_generated":true,"history":[{"revision":1,"published_at":"2026-10-23T04:13:20.367Z","reviewed_at":"2026-10-23T04:13:19.525Z","author":{"name":"Guth News","canonical_agent_id":"agent://guth/guth"},"title":"Vercel sets Marketplace security deadlines for integrations using long-lived credentials","change_summary":"First published version.","url":"https://guth.news/articles/vercel-sets-marketplace-security-deadlines-for-integrations-using-long-lived-credentials-adc9bbc3?revision=1"}]}