Vercel sets January 2027 security deadline for Marketplace vendors
Integrations that fail Vercel’s authentication requirements face warning labels by November 30 and possible delisting if they do not comply by January 2027.
Loading… Բեռնվում է…
Integrations that fail Vercel’s authentication requirements face warning labels by November 30 and possible delisting if they do not comply by January 2027.
Vercel is giving Marketplace vendors until January 2027 to offer secure authentication or face delisting. For customers deploying applications through GitHub Actions, the company said on 23 October that a replacement for persistent deployment tokens was mid-rollout.
The policy, announced on 22 October, targets long-lived access keys that can remain valid indefinitely.
In a 25 October 2026 correction to its 23 October article, The New Stack clarified that the documented GitHub Actions workflow is for Vercel customers, not Vercel’s internal deployments. The outlet revised its earlier “double standard” characterization.
Customers following that application-deployment guide still need a secret named VERCEL_TOKEN. Vercel’s 22 October announcement had already said it was extending OpenID Connect (OIDC), an identity-based authentication standard, across its application programming interface (API) and command-line interface (CLI). The company said its own API and native integrations would meet the same authentication standard as Marketplace vendors.
On 23 October, Vercel chief technology officer Malte Ubl said deployment authentication was “mid rollout” and would also give developers finer control over which actions a credential permits. His reply gave no completion date; it did not announce completed availability.
Static API keys let software access a service and can remain valid indefinitely. Vercel is promoting OIDC and short-lived, identity-based tokens as alternatives. These tokens expire rather than leave access open indefinitely.
The W27 keeps the Galaxy Z Fold 8 Ultra’s core hardware, with dark-red or dark-blue finishes, golden accents and 16GB of working memory in both storage versions.
2 min
Vercel chief executive Guillermo Rauch argued that expiration limits how long attackers can use stolen credentials. He acknowledged that attacks and breaches can still happen; the aim is to prevent a stolen key from providing lasting access.
In the 22 October announcement, Ubl said Vercel surveyed more than 1,000 software-as-a-service vendors and found that 8.4% supported authentication methods the company considers secure. The announcement did not give the survey methodology or identify the companies surveyed.
Separately from application deployments, Vercel added GitHub OIDC authentication for its Container Registry on 25 September. Customers can use it to upload container images—packages of software and its dependencies—without storing long-lived registry credentials.
Vercel says Connect lets applications and agents use their deployment identity to request credentials with limited permissions while running, rather than store secrets in their application environments. For supported OAuth services, which use an authorization standard, Connect handles token exchange and renewal.
Connect also supports providers that use static API keys rather than OAuth or another identity-based option. Its documentation describes storing those keys centrally and retrieving them when needed. Moving their storage does not make them short-lived: the underlying keys can remain valid indefinitely.
Vercel has not disclosed how many existing Marketplace partners need to change their authentication systems. Under its timetable, vendors still relying on long-lived secrets without supporting OIDC authentication will receive a “Not secure” listing warning on 30 November. Vendors that do not offer secure authentication by January 2027 will be delisted.
The satellite operator expects access to more than twice OneWeb’s current bandwidth in return for spending in 2027–2034, with initial IRIS² services expected from 2030.
3 min
The black, gold and green edition follows September’s sold-out preorders. Nintendo’s replenished launch-day stock also quickly sold out.
1 min