Death to long-lived static credentials
Vercel is phasing out long-lived static credentials in favor of short-lived OIDC tokens to reduce security risks from credential leaks and supply-chain attacks across its platform and Marketplace integrations.
Fifteen years ago, HTTPS encryption became the default for web traffic after a coordinated industry push, transforming security from an exception to an expectation. Machine-to-machine authentication has lagged behind, with many SaaS vendors still relying on long-lived static credentials like API keys, which persist indefinitely and grant broad access if compromised. These credentials can leak through code repositories, chat logs, or prompt injection attacks, allowing attackers to exploit them until manually revoked, often disrupting production systems during rotation.
Vercel’s new approach replaces static keys with OpenID Connect (OIDC), which issues short-lived, signed tokens tied to specific tasks or services. Applications authenticate by presenting these tokens, which expire quickly, limiting the window for misuse even if leaked. Vercel has already implemented OIDC federation for services like Blob, AI Gateway, and Sandbox, allowing temporary credentials for AWS, Google Cloud, and Azure under configured trust policies.
To accelerate adoption, Vercel introduced OIDC UI, a shadcn/ui registry with trust-policy forms and token verification tools for major providers including GitHub, AWS, and Azure. The platform reduces latency by reusing unexpired tokens and caching provider credentials, while Vercel Connect enables runtime token requests without storing long-lived secrets in environment variables.
The Marketplace initiative targets third-party vendors, aiming to make secure authentication automatic for integrations like databases and CMS tools. Vercel’s goal is to eliminate the need for developers to manage static keys by embedding OIDC support directly into workflows, ensuring security becomes the default without adding complexity.