Death to long-lived static credentials
By Steven Van ·
Vercel is adding OIDC tooling for providers and tightening authentication rules for Marketplace integrations, aiming to replace API keys and passwords.
Vercel says it is expanding OIDC support across its own services and setting new authentication requirements for providers in its Marketplace. The aim is to move machine-to-machine authentication away from long-lived static credentials such as API keys and database passwords.
What Vercel is shipping
- OIDC UI: a shadcn/ui registry that gives providers trust-policy forms and token verification code.
- Wider OIDC support across Vercel's own services.
- New authentication requirements for Marketplace providers.
The case against static credentials
Vercel describes long-lived static credentials as secrets that applications keep reusing, often with no expiration. It says they can leak into a code repository or chat, be stolen when a service or dependency is compromised, or be exposed when prompt injection leads an agent to reveal them. Until the credential expires or is revoked, an attacker can use it with all the permissions it grants.
Vercel also says rotating exposed credentials takes time and coordination across the systems that use them. It reports spending thousands of engineering hours on several key rotations and says it never wants to repeat that.
Sandbox as an example
The linked Sandbox documentation shows the OIDC approach in practice. The Sandbox SDK uses Vercel OIDC tokens when they are available and treats them as the recommended method. For local development, vercel link followed by vercel env pull writes a VERCEL_OIDC_TOKEN to .env.local. That token expires after 12 hours. When code runs on Vercel, token expiration is managed automatically.
Access tokens remain available for external CI/CD systems and non-Vercel hosting, where VERCEL_OIDC_TOKEN is unavailable. They need a team ID, a project ID and a Vercel access token.