From the source
Vercel is expanding OIDC support across its platform and setting new authentication requirements for Marketplace providers, arguing that long-lived static credentials should stop being the default.
- The company says secrets such as API keys and database passwords are reused with no expiration, and can leak into a repository or chat, be stolen when a dependency is compromised, or be exposed by prompt injection.
- Vercel surveyed more than 1,000 SaaS vendors and found that only 8.4% supported secure authentication methods.
- It names three barriers to adoption: tooling and setup that make secure authentication harder than a static key, added latency from fetching tokens on the request path, and weak vendor incentives.
- Vercel Connect lets applications and agents request provider tokens at runtime using their deployment identity, so long-lived provider secrets need not sit in environment variables.
- OIDC UI, a shadcn/ui registry, gives providers trust-policy forms and server-side token verification for Vercel,
GitHub, GitLab, Google, Bitbucket, AWS, Azure and custom issuers.
