---
title: Vercel will label Marketplace integrations "Not secure" from Nov 30 unless they support OIDC instead of long-lived API keys, and delist them in January | ctxsec
url: https://ctxsec.com/items/vercel-oidc-marketplace-static-key-deadline
description: ""
status: "confirmed (Vercel blog, Oct 22)"
published: 2026-10-22
---

> 

[← Industry News](/industry) · [markdown](/items/vercel-oidc-marketplace-static-key-deadline.md)

confirmed (Vercel blog, Oct 22)

2026-10-22

### Vercel will label Marketplace integrations "Not secure" from Nov 30 unless they support OIDC instead of long-lived API keys, and delist them in January

In a post titled "Death to long-lived static credentials", Vercel says only **8.4%** of 1,000+ SaaS vendors it surveyed support secure machine authentication such as OIDC or workload identity federation. It points to recent credential-theft and supply-chain incidents, and to agents that can be prompt-injected into revealing keys, as reasons static keys must go. Marketplace providers must support Vercel-issued OIDC tokens: non-compliant listings get a "Not secure" label from **Nov 30, 2026** and are delisted in **January 2027**. Vercel also published OIDC UI (a shadcn/ui registry with trust-policy forms and token verification code) and says Vercel Connect, which issues short-lived, task-scoped provider tokens at runtime, is generally available. For defenders, this is a good prompt to inventory which of your vendors accept OIDC federation today.

Sources: [Vercel: Death to long-lived static credentials (Oct 22)](https://vercel.com/blog/death-to-long-lived-static-credentials) · [Vercel: The end of credential sprawl for agents](https://vercel.com/blog/the-end-of-credential-sprawl-for-agents)