- Vercel plans a "Not secure" label by November 30, 2026 for Marketplace vendors without OIDC support that use long-lived secrets, and delistings by January 2027, with criteria undefined.
- Vercel's own survey, method undisclosed, found 8.4% of more than 1,000 SaaS vendors support secure authentication. The post does not say they were Marketplace vendors.
- Short-lived tokens shorten how long a stolen credential works, not what it can do. Leaders can inventory long-lived keys and ask vendors about OIDC.
A leaked key is dangerous because it keeps working
Much of security practice centres on keeping secrets secret. Vercel's October 22 blog post argues for a different goal: make the secret expire, so a stolen copy has a short useful life.
The post is about API keys and database passwords that an application reuses again and again, often with no end date. Its concern is the thief's side of the bargain. Until the key expires or someone revokes it, a stolen copy opens everything the key was allowed to open.
The post names three ways a key escapes. It can end up in a code repository or a chat. It can be taken when a service or software dependency is compromised. Or an AI agent can be tricked into revealing it through prompt injection, which means hiding instructions in content the agent reads.
Agents sharpen the problem. Vercel says the access it gives them is often broader than the task needs.
How short-lived access works
The alternative Vercel promotes is OIDC (OpenID Connect), a standard for proving identity. Instead of storing a permanent key, the application carries a signed token from a trusted issuer. The token says who the application is and soon stops working. The service on the other end checks it before granting access.
The post says a stolen token is useless once it expires, even if nobody notices the theft. The application can also request new credentials by itself, so no one has to copy a permanent key to many systems and replace it by hand.
Vercel gives one example. An application can reach an Azure Cosmos DB database without a database key. Azure is set to trust the Vercel project. The app hands Vercel's token to Azure, which swaps it for a temporary Azure access token.
Vercel's identity-token federation has been generally available since 2024. A deployment can present a Vercel-issued token to AWS, Google Cloud or Azure and receive temporary credentials in return. Vercel is now extending the approach to its own Blob, AI Gateway and Sandbox services.
What expiry does not fix
Expiry shortens the time a stolen copy works. It does not limit what an attacker can do during that time.
The post describes two controls that narrow a token's reach. A trust policy states which issuer the provider accepts, tied to a particular Vercel project and environment. A custom audience marks each token for the one service meant to receive it. A token that is scoped this way is worth less to a thief.
There is a further limit, and it is WebPulse's analysis, not a claim in the post. Code running inside an application that can obtain tokens could also request new ones while the compromise lasts. The post does not address that case.
So treat short-lived tokens as one control, not a full defence. Narrow permissions and monitoring still matter.
The cost of rotation falls on people
Replacing an exposed key is slow work. Vercel says it needs coordination across every system that uses the key, and errors can disrupt production.
Vercel also describes its own experience. It says it spent thousands of engineering hours on several rotations, which it calls "very painful", and that it did them "out of an abundance of caution". The company says it never wants to do that again.
That is the human case for expiring credentials, drawn from one company's experience. After a leak, or even a scare, engineers must find every place a key lives. With short-lived tokens there is less permanent material to hunt down.
Why static keys persist
Vercel reports a survey of more than 1,000 SaaS vendors. Only 8.4% of them, it says, offered secure ways to authenticate. The post does not say how the vendors were chosen. It does not say they are Marketplace vendors. Treat the figure as Vercel's own measurement.
The company names three barriers. Setup is harder than pasting a key. Fetching tokens adds delay on the request path. And vendors have weak incentives to build secure options.
The delay point is real. A key in an environment variable needs no network call, while a token fetch or exchange does. Vercel says it reduces this cost by reusing unexpired tokens and caching provider tokens, though custom-audience and provider exchanges still need network calls.
A deadline borrowed from HTTPS
Vercel compares the moment to the push for HTTPS. In its telling, encryption spread because Chrome first labelled plain HTTP "Not secure" and then set deadlines.
Vercel now plans to do the same on its Marketplace. Its deadline is November 30, 2026. By then, a vendor that cannot accept OIDC authentication from Vercel and still relies on long-lived secrets will get a comparable "Not secure" notice on its listing. Vercel says its own API and native integrations are held to the same bar.
The company adds a second step. Vendors that still offer no secure authentication are to be removed from the Marketplace by January 2027. These are announced intentions in a company blog post. The post does not define "secure authentication" for delisting or say exactly what vendors must do.
This is one platform's policy, not an industry rule. Vercel also builds the tooling it recommends, including Vercel Connect and a component set called OIDC UI. How many Marketplace vendors respond is not yet known.
What to ask your team
Start with an inventory. Which API keys and database passwords do your applications hold, and which have no expiry date?
Then ask each vendor whether it accepts OIDC tokens or exchanges them for temporary credentials. If a vendor sells through a marketplace, ask whether it has a plan for these dates.
Review the access your AI agents hold. Is each credential limited to the task, or does it carry broad permissions? Ask your team to time a full key rotation, and treat the answer as a measure of exposure.
The lesson is a modest one. Hiding a secret is a bet that it will not leak. Giving it a short life can make a leak cost far less, though it does not remove the need to limit what the secret allows.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Vercel.
