---
type: "post"
id: "death-to-long-lived-static-credentials-ce34e4"
slug: "death-to-long-lived-static-credentials-ce34e4"
title: "Death to long-lived static credentials"
description: "Vercel said it is expanding use of OpenID Connect (OIDC) and short-lived credentials across its platform and Marketplace."
retrieval_nugget: "Vercel said it is expanding use of OpenID Connect (OIDC) and short-lived credentials across its platform and Marketplace."
published_at: "2026-10-22"
updated_at: "2026-10-22"
record_date: "2026-10-22"
date_kind: "published_at"
topics: ["google"]
entities: ["Vercel","Vercel Marketplace","OIDC","Vercel Connect","Vercel API","Vercel CLI","OIDC UI"]
related_patterns: ["agent-security-moves-to-runtime-boundaries","agent-ready-software-exposes-capabilities"]
novelty_label: "new_fact"
what_changed: "Vercel now describes a broader push to make OIDC and short-lived credentials standard across its services and Marketplace, including OIDC UI and new provider authentication requirements."
prior_refs: ["memory:a4927e1b-190b-8e8f-ad68-ec453300454e","memory:4c3626af-7f67-862d-a0aa-170d1e4d44d0","memory:c0d7f62f-0045-8e49-a7ff-fff46c2eaccd"]
source_url: "https://vercel.com/blog/death-to-long-lived-static-credentials"
source_urls: ["https://vercel.com/blog/death-to-long-lived-static-credentials"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:death-to-long-lived-static-credentials-ce34e4"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/death-to-long-lived-static-credentials-ce34e4/","markdown":"https://newruntime.com/posts/death-to-long-lived-static-credentials-ce34e4.md","json":"https://newruntime.com/posts/death-to-long-lived-static-credentials-ce34e4.json"}
---

# Death to long-lived static credentials

## Retrieval answer

Vercel said it is expanding use of OpenID Connect (OIDC) and short-lived credentials across its platform and Marketplace.

Vercel said it is expanding use of OpenID Connect (OIDC) and short-lived credentials across its platform and Marketplace. The company said it is extending OIDC support to the Vercel API and CLI, aiming to remove the need for long-lived Vercel tokens in deployment workflows.

The company also introduced OIDC UI, a shadcn/ui component registry with trust-policy configuration forms and server-side token-verification code. Vercel lists Vercel, GitHub, GitLab, Google, Bitbucket, AWS, Azure, and custom OIDC issuers among the supported provider forms. Its existing federation can exchange Vercel-issued identity tokens for temporary AWS, Google Cloud, and Azure credentials under configured project and environment policies.

For Marketplace vendors, Vercel set two deadlines. By November 30, 2026, listings that use long-lived secrets and do not support OIDC authentication from Vercel will receive a “Not secure” message. In January 2027, vendors that do not offer secure authentication will be delisted. Vercel said a survey of more than 1,000 SaaS vendors found 8.4% supported secure authentication methods.

The announcement does not establish how many Marketplace vendors will meet the deadlines, how enforcement will work in individual cases, or whether the policy will increase OIDC adoption outside Vercel's Marketplace.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Google](https://newruntime.com/topics/google.md): Explore the google topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)