The company said it is extending OIDC support to the Vercel API and CLI, aiming to remove the need for long-lived Vercel tokens in deployment workflows.
The company also introduced OIDC UI, a shadcn/ui component registry with trust-policy configuration forms and server-side token-verification code. Vercel lists Vercel, GitHub, GitLab, Google, Bitbucket, AWS, Azure, and custom OIDC issuers among the supported provider forms. Its existing federation can exchange Vercel-issued identity tokens for temporary AWS, Google Cloud, and Azure credentials under configured project and environment policies.
For Marketplace vendors, Vercel set two deadlines. By November 30, 2026, listings that use long-lived secrets and do not support OIDC authentication from Vercel will receive a “Not secure” message. In January 2027, vendors that do not offer secure authentication will be delisted. Vercel said a survey of more than 1,000 SaaS vendors found 8.4% supported secure authentication methods.
The announcement does not establish how many Marketplace vendors will meet the deadlines, how enforcement will work in individual cases, or whether the policy will increase OIDC adoption outside Vercel's Marketplace.