Vercel moved to kill static credentials. Then developers spotted its own deployment token.

Vercel is pushing the ecosystem to eliminate persistent API keys in favor of OpenID Connect (OIDC) and short-lived identity-based tokens, with a January 2027 deadline for Marketplace vendors or risk delisting. The push follows multiple supply chain attacks leveraging stolen credentials, including recent npm worms. However, developers have pointed out that Vercel's own GitHub Actions deployment workflow still relies on the static credentials the company now discourages, creating a credibility gap.

Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. The New Stack did the reporting; read the original for the full story.