Get Started

Death to long-lived static credentials

SecuritySecurityCloud Infrastructure

First reported · 2d ago · Updated · 2 sources

Crest summary — written by AI from the 2 sources below; every figure is checked against them · model deepseek-flash

Summary

Vercel is moving to eliminate long-lived API keys from its ecosystem and has given Marketplace vendors until January 2027 to comply, after developers spotted its own deployment token.

Key facts

  • Vercel set a January 2027 deadline for Marketplace vendors.
  • The effort targets long-lived API keys in Vercel's ecosystem.
  • Developers found a Vercel deployment token during the push.

Why it matters

Vendors building on Vercel's Marketplace must plan to replace static credentials before January 2027, and the token finding shows such credentials can persist in unexpected places.

Companies

Technologies

  • HTTPSprotocol
  • TLSprotocol

Original sources (2)

The 2 reports this event was built from. Crest of Tech keeps no article bodies: the full text is at each source.

  1. VercelOfficial · Primary
    Death to long-lived static credentials · By Malte Ubl
    Read at Vercel
  2. The New StackOfficial
    Vercel moved to kill static credentials. Then developers spotted its own deployment token. · By Amanda Caswell
    Read at The New Stack
Death to long-lived static credentials — Crest of Tech