Vercel wants to eliminate long-lived API keys from its ecosystem, and it is giving Marketplace vendors until January 2027 to comply or risk being delisted, a push that lands as a run of credential-stealing supply chain attacks — including a recent npm worm that scraped tokens straight out of CI pipelines — keeps proving how much damage a single leaked secret can do.
Vercel’s own GitHub Actions deployment workflow still relies on the kind of persistent credential the company now wants gone.
Developers have already pointed out a complication, though: Vercel’s own GitHub Actions deployment workflow still relies on the kind of persistent credential the company now wants gone.
In a Thursday announcement, Vercel CTO Malte Ubl says the company surveyed more than 1,000 SaaS vendors and found that only 8.4% supported what Vercel considers secure authentication methods, and it is now pushing OpenID Connect (OIDC) and short-lived, identity-based tokens as the alternative to static API keys that can stay valid indefinitely.
Vercel CEO Guillermo Rauch amplifies the message on X, writing that it is “time to kill ‘static credentials’” and arguing that while attacks and breaches can still happen, stolen credentials should behave more like “self-destructing keys” that expire before an attacker can keep using them.
Developer and senior software engineer at Fanatics, Yordis Prieto sharpens that point, writing in reply that Vercel had “invented” OIDC federation yet still left him leaning on “a long-lived access token” in his CI pipeline, and he presses the company to drop the token requirement from GitHub CI while criticizing its non-expiring token option.
Source link
