Vercel pushes to kill static credentials while its own deploy flow still uses VERCEL_TOKEN

Vercel has given Marketplace vendors until January 2027 to adopt OIDC and short-lived tokens instead of static API keys or face delisting. Developers noted that Vercel's own GitHub Actions deployment guide still requires a persistent VERCEL_TOKEN secret.

• Only 8.4% of 1,000+ surveyed SaaS vendors support secure authentication by Vercel's definition
• Integrations falling short get a "Not secure" label from November 30, delisting from January 2027
• Vercel's GitHub Actions guide still requires the VERCEL_TOKEN secret
• Vercel Connect still supports static API keys for providers without OAuth