AI Briefing
KOSign in

Vercel to delist Marketplace vendors lacking OIDC support by January 2027

·2026.10.22 09:00

Key point

A survey of over 1,000 SaaS vendors found only 8.4% support secure authentication, prompting Vercel to enforce OIDC standards to replace static credentials.

1 / 4

Details

  • Vercel is enforcing new authentication requirements for its Marketplace, requiring vendors to support OIDC or face delisting by January 2027.
  • A survey of more than 1,000 SaaS vendors revealed that only 8.4% currently support secure authentication methods, with long-lived static credentials remaining the default for most.
  • The company argues that static credentials are insecure because they can leak into repositories or be exposed via prompt injection, allowing attackers to retain access until manual rotation.
  • Vercel is deploying OIDC UI, a shadcn/ui registry providing trust-policy forms and token verification code, to make secure authentication easier to implement than using static keys.
  • To reduce latency, Vercel Functions receive platform-issued tokens in request headers, and Vercel Connect caches provider tokens to minimize network calls during token exchange.
  • Vendors who do not support OIDC auth will display a "Not secure" label on their listings by November 30, 2026, before being removed from the Marketplace in January 2027.
securityvercelauthenticationoidcmarketplaceapi-keys
Read originalShare on Threads

This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.

Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.

Related

Vercel BlogVercel Sandbox Challenge Uncovers Linux Kernel Zero-Day and Pays $242,000 in BountiesVercel BlogAmazon S3 joins the Vercel MarketplaceHacker NewsNvidia OpenShell: Secure Runtime for Autonomous AI Agent FleetsAWS BlogAWS Continuum for code vulnerabilities reaches general availabilityAnthropic ResearchAnthropic and Theorem prove security properties for 123 open-source libraries using LLM-driven formal verificationCloudflare BlogCloudflare WAF adds full transaction detection and response rules