Vercel moved to kill static credentials. Then developers spotted its own deployment token.
Vercel wants to eliminate long-lived API keys from its ecosystem, and it is giving Marketplace vendors until January 2027 to The post Vercel moved to kill static credentials. Then developers spotted its own deployment token. appeared first on The New Stack .
Vercel aims to phase out long-lasting API keys from its platform by giving Marketplace vendors until January 2027 to comply, or face delisting. The company is pushing for OpenID Connect (OIDC) and short-lived, identity-based tokens as alternatives to static credentials which can remain valid indefinitely. Nevertheless, Vercel's official GitHub Actions deployment workflow still requires the long-lived VERCEL_TOKEN secret.
Written by urgent.news from The New Stack's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
