On November 30, 2026, Vercel starts labeling some Marketplace vendors "Not secure." If your API still asks Vercel customers to paste a long-lived API key into an environment variable, that label is aimed at you. Here's what the change says, what your options are, and what an OIDC token exchange looks like. What Vercel announced In Death to long-lived static credentials (Oct 22, 2026), Vercel set two dates: By November 30, 2026: vendors that don't support OIDC auth fr...