Vercel Shifts to OIDC for Secure Authentication

What happened

Vercel is enhancing its security measures by shifting from long-lived static credentials to OpenID Connect (OIDC). This change is part of a broader initiative to make secure authentication the default in its services and integrations.

The decision comes after recognizing the risks associated with long-lived credentials, such as API keys and database passwords, which are vulnerable to leakage and misuse.

Why it matters

The risks of long-lived credentials have been highlighted by past incidents, including credential theft and supply-chain attacks. These events have prompted Vercel to seek more secure authentication methods to protect its users and services.

Key details

Only 8.4% of surveyed SaaS vendors currently support secure authentication methods, indicating a lack of industry-wide adoption. Vercel aims to address this by expanding OIDC support across its API and CLI.

The company is also working on its Marketplace to encourage third-party vendors to support short-lived, identity-based authentication. Additionally, Vercel Connect enables applications to request provider tokens at runtime without storing long-lived secrets in environment variables.