Vercel sets a January deadline to kill static API keys
A survey of over 1,000 SaaS vendors found just 8.4% support OIDC. Non-compliant Marketplace listings get a warning badge from 30 November, then delisting in January.
Vercel announced on 22 October that it is pushing every Marketplace vendor off long-lived static API keys and onto OpenID Connect. The company surveyed more than 1,000 SaaS vendors and found that only 8.4% currently support a secure, short-lived authentication method instead of a plain API key sitting in an environment variable.
From 30 November, any Marketplace listing that doesn’t support OIDC gets a “Not secure” warning badge next to its name. Vendors still non-compliant after that are delisted entirely in January 2027. To make the switch easier, Vercel is shipping an OIDC component library built on shadcn/ui, with ready-made trust-policy forms and token-verification code, and extending Vercel Connect so an app can request a provider token at runtime instead of storing one long-term.
Why it matters: if you maintain a Marketplace integration, or your stack leans on one, check whether it supports OIDC before 30 November, since the warning badge is the kind of thing that costs you installs. Vercel says it is holding its own API and native integrations to the same bar, so this isn’t just a third-party-vendor problem.
The caveat: OIDC support is self-reported by vendors for now; the badge is a trust signal, not an audit.