Vercel Marketplace Vendors Must Adopt OIDC by 2027

New requirements aim to replace static keys with identity-based tokens to secure supply chain integrations.

Updated on Oct. 23, 2026 in Software

Bold flat-color editorial illustration showing a geometric metallic key hovering above a server base, representing secure identity token transitions. — Vercel will require all Marketplace vendors to implement OIDC-based authentication by 2027, replacing static API keys to improve supply chain security. AI Illustration. Upload story photo >

Live Poll

Should software companies be required to follow the same security standards they demand from their vendors?

Vercel announced that all Marketplace vendors must replace static, long-lived API keys with OIDC-based authentication by January 2027. Integrations failing to meet security requirements will display a 'Not secure' warning starting November 30, 2026.

Why it matters

The mandate aims to mitigate the risk of credential-stealing supply chain attacks by forcing a move toward short-lived, identity-based tokens. This shift targets a significant security gap, as current survey data shows a low adoption rate for modern authentication standards.

Only 8.4% of 1,000 surveyed SaaS vendors currently support secure authentication, leaving the vast majority dependent on static keys. The extent of vulnerabilities in internal developer workflows remains under investigation.

The players

Vercel

A cloud platform provider specializing in front-end development and serverless infrastructure.

GitHub Actions

An automation service for CI/CD pipelines that currently requires static tokens for Vercel deployments.

The details

Vercel Connect facilitates this transition by allowing applications to request scoped credentials at runtime rather than relying on static tokens. The platform handles the token exchange and renewal processes automatically using the deployment identity. While this mechanism limits the window for attackers to exploit stolen credentials, developers have noted that Vercel still requires a static VERCEL_TOKEN for its own GitHub Actions deployment workflows.

September 2026: GitHub OIDC introduced for Container Registry.
October 15, 2026: Enterprise-managed authorization added to Connect in public beta.
October 22, 2026: Vercel announced the OIDC transition requirements.
November 30, 2026: 'Not secure' warnings appear on non-compliant listings.
January 2027: Final compliance deadline for Marketplace vendors.

The Tech Race

Vercel is following a pattern set by industry-wide adoption of GitHub OIDC to replace persistent, high-risk credentials. The move aligns the platform with modern security standards to defend against supply chain attacks.

Marketplace vendors must update their authentication methods before the January 2027 deadline to avoid being delisted. Developers utilizing GitHub Actions should monitor for future updates, as the platform currently still relies on static tokens for its own internal deployment workflows.

The takeaway

Vercel is forcing a structural shift in how third-party integrations handle security to prevent long-term credential misuse. Developers should track the platform's progress in phasing out its own reliance on static tokens in VERCEL_TOKEN-based workflows.