{
  "id": 16224184,
  "title": "Vercel moved to kill static credentials. Then developers spotted its own deployment token.",
  "url": "https://urgent.news/2026/10/23/vercel-moved-to-kill-static-credentials-then-developers-spotted-its",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-23T20:04:16.000Z",
  "source": {
    "name": "The New Stack",
    "slug": "the-new-stack",
    "url": "https://thenewstack.io/vercel-oidc-static-credentials/"
  },
  "original_language": "en",
  "account": "Vercel aims to phase out long-lasting API keys from its platform by giving Marketplace vendors until January 2027 to comply, or face delisting. The company is pushing for OpenID Connect (OIDC) and short-lived, identity-based tokens as alternatives to static credentials which can remain valid indefinitely. Nevertheless, Vercel's official GitHub Actions deployment workflow still requires the long-lived VERCEL_TOKEN secret.",
  "summary": "Vercel wants to eliminate long-lived API keys from its ecosystem, and it is giving Marketplace vendors until January 2027 to The post Vercel moved to kill static credentials. Then developers spotted its own deployment token. appeared first on The New Stack .",
  "key_points": [
    "Vercel plans to phase out static credentials by 2027",
    "Marketplace vendors must comply or face delisting",
    "Official GitHub Actions deployment token still required"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}