Give Apps Access without Keeping Long-Term Secret Keys

Apps often keep secret keys to use another company's service. A key can allow access for a very long time. If someone steals it, they can use the access it gives. The key keeps working until it expires or someone stops it. Vercel wants to change this common way of connecting services.

The company supports a method called OIDC for checking an app's identity. OIDC lets one service check which app is asking for access. It uses a token, a short piece of information that proves identity. The token works for a limited time instead of remaining useful forever. The app can get a new one when it needs access again.

Better security alone does not always make developers change their habits. A secret key can be easier to set up and use. Getting a new token can also add time to a request. Vercel is improving its tools to make these steps simpler. It also reuses tokens that still work to reduce extra requests.

Vercel Connect lets apps request access without keeping long-term keys from providers. Its OIDC UI tools help providers build the required setup screens. These changes aim to make safer connections easier for both sides. Vercel says standards need useful tools before they become the normal choice.

The company is also setting requirements for its Marketplace providers. By November 30, 2026, certain providers will show a Not secure message. This applies to providers using long-term secrets without supporting OIDC from Vercel. By January 2027, providers without secure authentication will be removed. Vercel says its own services must meet the same standard too.