Vercel's Nov 30, 2026 deadline: accept OIDC tokens instead of static API keys, without building a token server.

Vercel says that by November 30, 2026, Marketplace vendors that still rely on long-lived secrets get a "Not secure" label, and by January 2027 vendors without secure auth are removed. We're building a small bridge so your existing API can accept short-lived tokens in days, not a quarter.

What it does

Open-source library you drop into your API: verifies the incoming OIDC token (Vercel, GitHub Actions, GitLab) against a trust policy your customer sets.
Maps it to your existing API-key permissions and returns a short-lived token, so your auth model doesn't change.
Optional hosted bridge for the token exchange, revocation and an audit log, if you don't want to run it yourself.
A ready "connect without a key" docs page you can adapt for your customers.

Who it's for

Small API and SaaS teams that already have their own API-key system, list (or want to list) on the Vercel Marketplace, and don't want to adopt a full identity platform just to meet the deadline.

Why now

Vercel surveyed more than 1,000 SaaS vendors and found only 8.4% support a secure, short-lived auth method. Vercel's free OIDC UI components give you the forms and token verification; storing policies, issuing your own short-lived token, revocation and audit are still on you.
Source: Vercel blog, "Death to long-lived static credentials" (Oct 22, 2026).

Not affiliated with or endorsed by Vercel. Keyless Bridge is a working name.