Vercel to label Marketplace vendors without OIDC "Not secure" from Nov 30

Starting November 30, 2026, Vercel will mark Marketplace vendors that accept long-lived API keys instead of OIDC tokens as "Not secure." Vendors without secure auth will be removed from the Marketplace by January 2027; Vercel's survey of 1,000+ SaaS vendors found only 8.4% support short-lived auth.

• From Nov 30, 2026, vendors without OIDC get a "Not secure" label in the Marketplace
• Vendors without secure auth will be removed from the Marketplace by January 2027
• Only 8.4% of 1,000+ surveyed SaaS vendors support short-lived auth
• Vercel published free shadcn/ui-based OIDC UI components for token verification