Introducing new token formats and secret scanning
By Steven Van ·
GitHub secret scanning now auto-revokes exposed Vercel credentials, and tokens carry new type-specific prefixes like vcp and vck.
Vercel now automatically revokes API credentials that turn up exposed in public GitHub repositories, gists or npm packages, using GitHub secret scanning to detect them. Affected users are notified and can review discovered tokens and API keys in their dashboard. The detection covers all Vercel and v0 accounts.
Token and API key formats have also changed to make credential types identifiable by prefix:
- vcp for personal access tokens
- vci for integration tokens
- vca for app access tokens
- vcr for app refresh tokens
- vck for API keys
Vercel recommends reviewing tokens and keys regularly, rotating long-lived credentials, and revoking unused ones.
Vercel
The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.
View Vercel →