In a post titled "Death to long-lived static credentials", Vercel says only 8.4% of 1,000+ SaaS vendors it surveyed support secure machine authentication such as OIDC or workload identity federation. It points to recent credential-theft and supply-chain incidents, and to agents that can be prompt-injected into revealing keys, as reasons static keys must go. Marketplace providers must support Vercel-issued OIDC tokens: non-compliant listings get a "Not secure" label from Nov 30, 2026 and are delisted in January 2027. Vercel also published OIDC UI (a shadcn/ui registry with trust-policy forms and token verification code) and says Vercel Connect, which issues short-lived, task-scoped provider tokens at runtime, is generally available. For defenders, this is a good prompt to inventory which of your vendors accept OIDC federation today.