Vercel wants static credentials gone. Its own GitHub Actions deploy still needs one

Vercel is giving Marketplace vendors until January 2027 to replace long-lived API keys with OIDC and short-lived tokens or risk being delisted. Developers point out that Vercel's own GitHub Actions deployment guide still authenticates with a persistent VERCEL_TOKEN secret.