# Vercel — Death to long-lived static credentials

- Company: Vercel (vercel.com)
- Announced: 2026-10-22T04:00:00+00:00
- Category: safety-policy-update
- Coverage: not counted
- Announcement: yes
- Group: announcements
- Source: https://vercel.com/blog/death-to-long-lived-static-credentials
- Record: https://forck.live/items/26906-death-to-long-lived-static-credentials
- Subject: v0 / AI SDK / AI Gateway

Vercel is expanding OIDC support across its platform and setting new authentication requirements for Marketplace providers, arguing that long-lived static credentials should stop being the default. The company says secrets such as API keys and database passwords are reused with no expiration, and can leak into a repository or chat, be stolen when a dependency is compromised, or be exposed by prompt injection. Vercel surveyed more than 1,000 SaaS vendors and found that only 8.4% supported secure authentication methods. It names three barriers to adoption: tooling and setup that make secure authentication harder than a static key, added latency from fetching tokens on the request path, and weak vendor incentives. Vercel Connect lets applications and agents request provider tokens at runtime using their deployment identity, so long-lived provider secrets need not sit in environment variables. OIDC UI, a shadcn/ui registry, gives providers trust-policy forms and server-side token verification for Vercel, GitHub, GitLab, Google, Bitbucket, AWS, Azure and custom issuers. Vercel says its OIDC federation has been generally available since 2024, and that it is extending OIDC across the Vercel API and CLI to remove long-lived Vercel tokens from deployment workflows.

## Evidence

Verbatim from https://vercel.com/blog/death-to-long-lived-static-credentials:

> We surveyed more than 1,000 SaaS vendors and found that only 8.4% supported secure authentication methods.

---

Record: https://forck.live/items/26906-death-to-long-lived-static-credentials
Catalogue: https://forck.live/llms.txt
Current issue: https://forck.live/feed.md