According to CoinMeta, Vercel has announced that it will phase out long-term static keys within its own marketplace. Starting from November 30th, third-party services that still rely on long-term keys and do not support Vercel OIDC authentication will be marked as "insecure," and by January 2027, such services will be taken down. Long-term keys are like keys that do not automatically expire; once leaked, attackers can use them for an extended period. The OIDC authentication promoted by Vercel allows programs to obtain temporary credentials based on their own identity, restricting access scope and permissions. After the credentials expire, SDK enables automatic re-obtaining of credentials and reduces additional requests through caching. Vercel itself has also experienced security incidents; in April, a third-party AI tool Context.ai was compromised, allowing attackers to gain access to Vercel's internal systems and read some customers' environment variables. A survey found that only 8.4% of SaaS service providers support safer authentication methods.